What’s Vulnerable › Products

git-lfs vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your git-lfs version is affected

Latest git-lfs vulnerabilities

• CVE-2025-26625 — Git LFS may write to arbitrary files via crafted symlinks (CVSS 8.6)
• CVE-2024-53263 — Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVSS 8.5)
• CVE-2022-24826 — Git LFS can execute a binary from the current directory on Windows (CVSS 7.8)
• CVE-2021-21237 — Git LFS can execute a Git binary from the current directory on Windows (CVSS 7.8)
• CVE-2020-27955 — (CVSS 9.8)
• CVE-2017-17831 — (CVSS 8.8)