What’s Vulnerable › Vulnerabilities

CVE-2022-31012: Git for Windows' installer can be tricked into executing an untrusted binary

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-12 · updated 2026-06-17
• Weakness: CWE-426

Description

Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when upgrading Git for Windows. A patch is included in version 2.37.1. Two workarounds are available. Create the `C:\mingw64` folder and remove read/write access from this folder, or disallow arbitrary authenticated users to create folders in `C:\`.

Affected products

• Gitforwindows Git: before 2.37.1 — fixed in 2.37.1

How to fix

Upgrade to a fixed version: Gitforwindows Git 2.37.1. Check the vendor advisory for mitigations.

References

• https://github.com/git-for-windows/git/releases/tag/v2.37.1.windows.1
• https://github.com/git-for-windows/git/security/advisories/GHSA-gjrj-fxvp-hjj2
• https://github.com/git-for-windows/git/releases/tag/v2.37.1.windows.1
• https://github.com/git-for-windows/git/security/advisories/GHSA-gjrj-fxvp-hjj2

Get alerted when CVE-2022-31012 or the next vulnerability affects your stack