Skip to content
OpenAdvisories

Vendor

git-lfs

4 known vulnerabilities.

Products

git-lfs 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.6
    CVE-2025-26625

    Git LFS may write to arbitrary files via crafted symlinks

    Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git w…

    git-lfs git-lfs github.com/git-lfs/git-lfs github.com/git-lfs/git-lfs/v3 Debian Ubuntu Alpine Go
  • High 8.5
    CVE-2024-53263

    Git LFS permits exfiltration of credentials via crafted HTTP URLs

    Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then…

    git-lfs git-lfs github.com/git-lfs/git-lfs github.com/git-lfs/git-lfs/v3 Debian Ubuntu Go
  • High 7.2
    CVE-2021-21237

    Git LFS can execute a Git binary from the current directory on Windows

    Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitr…

    git-lfs git-lfs github.com/git-lfs/git-lfs Go