CVE-2021-28955

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-22 · updated 2026-06-17
Weakness: CWE-427

Description

git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on Windows).

Affected products

Git-Bug Project Git-Bug: before 0.7.2 — fixed in 0.7.2

How to fix

Upgrade to a fixed version: Git-Bug Project Git-Bug 0.7.2. Check the vendor advisory for mitigations.

References

https://github.com/MichaelMure/git-bug/security/advisories/GHSA-m898-h4pm-pqfr
https://vuln.ryotak.me/advisories/18
https://github.com/MichaelMure/git-bug/security/advisories/GHSA-m898-h4pm-pqfr
https://vuln.ryotak.me/advisories/18

Get alerted when CVE-2021-28955 or the next vulnerability affects your stack