CVE-2020-27955 — Git LFS can execute a Git binary from the current directory

Description

Git LFS 2.12.0 allows Remote Code Execution.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Git Remote Code Execution via git-lfs (CVE-2020-27955)
exploit/windows/http/git_lfs_rce

GitHub 18 repositories · most starred shown

ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955 ★ 30 · Nov 3, 2020

Git-lfs RCE exploit CVE-2020-27955 - tested on Windows on: git, gh cli, GitHub Desktop, Visual Studio, SourceTree etc.
r00t4dm/CVE-2020-27955 ★ 17 · Nov 24, 2020
ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go ★ 15 · Nov 4, 2020
DeeLMind/CVE-2020-27955-LFS ★ 1 · Apr 30, 2021
TheTh1nk3r/cve-2020-27955 ★ 1 · Dec 28, 2020

cve-2020-27955
Arnoldqqq/CVE-2020-27955 ★ 0 · May 13, 2021
IanSmith123/CVE-2020-27955 ★ 0 · May 6, 2021
HK69s/CVE-2020-27955 ★ 0 · Apr 30, 2021

CVE-2020-27955
NeoDarwin/CVE-2020-27955 ★ 0 · Mar 30, 2021

CVE-2020-27955 Poc
yhsung/cve-2020-27955-poc ★ 0 · Nov 22, 2020

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/git-lfs/git-lfs	< 2.12.1	2.12.1	GHSA-4g4p-42wc-9f3m

Advisories 1

WID-SEC-2022-1197 git: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 4, 2025

Git LFS can execute a Git binary from the current directory