What’s Vulnerable › Products
git vulnerabilities
43 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.
Check whether your git version is affected
Exploited git vulnerabilities
- CVE-2025-48384 — Git Link Following Vulnerability
Latest git vulnerabilities
- CVE-2025-48386 — Git allows a buffer overflow in 'wincred' credential helper (CVSS 6.3)
- CVE-2025-48385 — Git alllows arbitrary file writes via bundle-uri parameter injection (CVSS 8.6)
- CVE-2025-48384 — Git Link Following Vulnerability (CVSS 8.0) — exploited
- CVE-2024-32465 — Git's protections for cloning untrusted repositories can be bypassed (CVSS 7.8)
- CVE-2024-32021 — Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory (CVSS 7.1)
- CVE-2024-32020 — Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will (CVSS 3.3)
- CVE-2024-32004 — Git vulnerable to Remote Code Execution while cloning special-crafted local repositories (CVSS 7.8)
- CVE-2023-29007 — Arbitrary configuration injection via `git submodule deinit` (CVSS 7.8)
- CVE-2023-25652 — "git apply --reject" partially-controlled arbitrary file write (CVSS 7.5)
- CVE-2023-23946 — Git's `git apply` overwriting paths outside the working tree (CVSS 7.5)
- CVE-2023-22490 — Git vulnerable to local clone-based data exfiltration with non-local transports (CVSS 5.5)
- CVE-2022-41903 — Integer overflow in `git archive`, `git log --format` leading to RCE in git (CVSS 9.8)
- CVE-2022-23521 — gitattributes parsing integer overflow in git (CVSS 9.8)
- CVE-2022-41953 — Git clone remote code execution vulnerability in git-for-windows (CVSS 7.8)
- CVE-2022-39260 — Git vulnerable to Remote Code Execution via Heap overflow in `git shell` (CVSS 8.8)
- CVE-2022-39253 — Git subject to exposure of sensitive information via local clone of symbolic links (CVSS 5.5)
- CVE-2022-29187 — Bypass of safe.directory protections in Git (CVSS 7.8)
- CVE-2022-24765 — Uncontrolled search for the Git directory in Git for Windows (CVSS 7.8)
- CVE-2022-24975 — (CVSS 7.5)
- CVE-2021-40330 — (CVSS 7.5)
- CVE-2021-21300 — malicious repositories can execute remote code while cloning (CVSS 7.5)
- CVE-2020-11008 — Malicious URLs can still cause Git to send a stored credential to the wrong server (CVSS 7.5)
- CVE-2020-5260 — malicious URLs may cause Git to present stored credentials to the wrong server (CVSS 7.5)
- CVE-2014-9390 — (CVSS 9.8)
- CVE-2019-1353 — (CVSS 9.8)