Description
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dulwich | 0.10.1-1 | — |
| Debian 14 | git | 1:2.1.4-1 | — |
| Debian 14 | jgit | 3.7.0-1 | — |
| Debian 14 | libgit2 | 0.21.3-1 | — |
| Debian 14 | mercurial | 3.1.2-2 | — |
| Debian 13 | dulwich | 0.10.1-1 | — |
| Debian 13 | git | 1:2.1.4-1 | — |
| Debian 13 | jgit | 3.7.0-1 | — |
| Debian 13 | libgit2 | 0.21.3-1 | — |
| Debian 13 | mercurial | 3.1.2-2 | — |
| Debian 12 | dulwich | 0.10.1-1 | — |
| Debian 12 | git | 1:2.1.4-1 | — |
| Debian 12 | jgit | 3.7.0-1 | — |
| Debian 12 | libgit2 | 0.21.3-1 | — |
| Debian 12 | mercurial | 3.1.2-2 | — |
| Debian 6.0 | mercurial | 1.6.4-1+deb6u1 | DLA-237-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | git | 1:1.9.1-1ubuntu0.1 | USN-2470-1 |
| Ubuntu 14.04 LTS | mercurial | 2.8.2-1ubuntu1.3 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | libgit2 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git | 2.11.0-1.1 | openSUSE-SU-2024:10099-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Malicious Git and Mercurial HTTP Server For CVE-2014-9390
exploit/multi/http/git_client_command_exec
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jgit:org.eclipse.jgit | < 3.5.3 | 3.5.3 | GHSA-6vvc-c2m3-cjf3 |
| PyPI | mercurial | < 3.2.3 | 3.2.3 | PYSEC-2020-217 |
Advisories 3
- USN-2470-1 git vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-237-1 mercurial - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10099-1 git-2.11.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://news.ycombinator.com/item?id=8769667
- http://article.gmane.org/gmane.linux.kernel/1853266
- http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://support.apple.com/kb/HT204147
- https://github.com/blog/1938-git-client-vulnerability-announced
- http://securitytracker.com/id?1031404
- https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915
- https://libgit2.org/security/