Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.4 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.032, the 88th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:22 UTC First seen by agentprime
- 31 Oct 2026, 15:22 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-86c2-4x57-wc8g
- OSV: GHSA-86c2-4x57-wc8g
- github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g
- nvd.nist.gov/vuln/detail/CVE-2024-50338
- git-scm.com/docs/git-credential#IOFMT
- github.com/dotnet/runtime/blob/e476b43b5cb42eb44ce23b1c7b793aa361624cf6/src/libraries/System.Private.CoreLib/src/System/IO/StreamReader.cs#L926
- github.com/git-ecosystem/git-credential-manager
- github.com/git-ecosystem/git-credential-manager/blob/ae009e11a0fbef804ad9f78816d84a0bc7e052fe/src/shared/Core/StreamExtensions.cs#L138-L141
- github.com/git-ecosystem/git-credential-manager/compare/749e287571c78a2b61f926ccce6a707050871ab8...99e2f7f60e7364fe807e7925f361a81f3c47bd1b
- github.com/git-ecosystem/git-credential-manager/releases/tag/v2.6.1
- github.com/git/git/blob/6a11438f43469f3815f2f0fc997bd45792ff04c0/credential.c#L311
- learn.microsoft.com/en-us/dotnet/api/system.io.streamreader?view=net-8.0