# git.

Every CVE that names git among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Git for Windows: git-credential-wincred Erase Path Heap Overflow](https://agentprime.io/advisories/CVE-2026-100408.md)
  `CVE-2026-100408` · CVE record: git-for-windows git · CVSS 4.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption
- [Git for Windows: git-credential-wincred OAuth Store Heap Overflow](https://agentprime.io/advisories/CVE-2026-100407.md)
  `CVE-2026-100407` · CVE record: git-for-windows git · CVSS 4.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption
- [Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows](https://agentprime.io/advisories/CVE-2026-62960.md)
  `CVE-2026-62960` · CVE record: git-for-windows git · CVSS 7.4 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, CWE-610
- [Git for Windows: \`git clone\` from manipulated repositories can leak NTLM hashes to arbitrary servers](https://agentprime.io/advisories/CVE-2026-32631.md)
  `CVE-2026-32631` · CVE record: git-for-windows git · CVSS 7.4 High · Not analysed yet · Published 15 Apr 2026 · Tags: Information disclosure
- [Git for Windows leaks NTLM hash when cloning from an attacker-controlled server](https://agentprime.io/advisories/CVE-2025-66413.md)
  `CVE-2025-66413` · CVE record: git-for-windows git · CVSS 7.4 High · Not analysed yet · Published 10 Mar 2026 · Tags: Information disclosure
- [Git allows arbitrary code execution through broken config quoting](https://agentprime.io/advisories/CVE-2025-48384.md)
  `CVE-2025-48384` · CVE record: git git · CVSS 8.1 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 8 Jul 2025 · Tags: Path traversal, CWE-436
- [Git alllows arbitrary file writes via bundle-uri parameter injection](https://agentprime.io/advisories/CVE-2025-48385.md)
  `CVE-2025-48385` · CVE record: git git · CVSS 8.6 High · Not analysed yet · Published 8 Jul 2025 · Tags: Path traversal, Command injection
- [Git allows a buffer overflow in 'wincred' credential helper](https://agentprime.io/advisories/CVE-2025-48386.md)
  `CVE-2025-48386` · CVE record: git git · CVSS 6.3 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Memory corruption
- [The sideband payload is passed unfiltered to the terminal in git](https://agentprime.io/advisories/CVE-2024-52005.md)
  `CVE-2024-52005` · CVE record: git git · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-116, CWE-150
- [Git does not sanitize URLs when asking for credentials interactively](https://agentprime.io/advisories/CVE-2024-50349.md)
  `CVE-2024-50349` · CVE record: git git · CVSS 2.1 Low · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-116, CWE-147, CWE-150
- [Newline confusion in credential helpers can lead to credential exfiltration in git](https://agentprime.io/advisories/CVE-2024-52006.md)
  `CVE-2024-52006` · CVE record: git git · CVSS 2.1 Low · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-116, CWE-147, CWE-150
- [Git's protections for cloning untrusted repositories can be bypassed](https://agentprime.io/advisories/CVE-2024-32465.md)
  `CVE-2024-32465` · CVE record: git git · CVSS 7.4 High · Not analysed yet · Published 14 May 2024 · Tags: Path traversal
- [Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory](https://agentprime.io/advisories/CVE-2024-32021.md)
  `CVE-2024-32021` · CVE record: git git · CVSS 3.9 Low · Not analysed yet · Published 14 May 2024 · Tags: CWE-547
- [Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will](https://agentprime.io/advisories/CVE-2024-32020.md)
  `CVE-2024-32020` · CVE record: git git · CVSS 3.9 Low · Not analysed yet · Published 14 May 2024 · Tags: CWE-281
- [Git vulnerable to Remote Code Execution while cloning special-crafted local repositories](https://agentprime.io/advisories/CVE-2024-32004.md)
  `CVE-2024-32004` · CVE record: git git · CVSS 8.2 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-114
- [Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution](https://agentprime.io/advisories/CVE-2024-32002.md)
  `CVE-2024-32002` · CVE record: git git · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.29 · Not analysed yet · Published 14 May 2024 · Tags: Path traversal, Unrestricted file upload
- [Git CMD erroneously executes \`doskey.exe\` in the current directory, if it exists](https://agentprime.io/advisories/CVE-2023-29012.md)
  `CVE-2023-29012` · CVE record: git-for-windows git · CVSS 7.3 High · Not analysed yet · Published 25 Apr 2023 · Tags: CWE-427
- [Git for Windows's config file of \`connect.exe\` is susceptible to malicious placing](https://agentprime.io/advisories/CVE-2023-29011.md)
  `CVE-2023-29011` · CVE record: git-for-windows git · CVSS 7.6 High · Not analysed yet · Published 25 Apr 2023 · Tags: CWE-427
- [Arbitrary configuration injection via \`git submodule deinit\`](https://agentprime.io/advisories/CVE-2023-29007.md)
  `CVE-2023-29007` · CVE record: git git · CVSS 7.0 High · Not analysed yet · Published 25 Apr 2023 · Tags: Other injection
- [Git looks for localized messages in the wrong place](https://agentprime.io/advisories/CVE-2023-25815.md)
  `CVE-2023-25815` · CVE record: git-for-windows git · CVSS 3.3 Low · Not analysed yet · Published 25 Apr 2023 · Tags: Path traversal, Memory corruption
- ["git apply --reject" partially-controlled arbitrary file write](https://agentprime.io/advisories/CVE-2023-25652.md)
  `CVE-2023-25652` · CVE record: git git · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.52 · Not analysed yet · Published 25 Apr 2023 · Tags: Path traversal
- [Git for Windows' installer is susceptible to DLL side loading attacks](https://agentprime.io/advisories/CVE-2023-22743.md)
  `CVE-2023-22743` · CVE record: git-for-windows git · CVSS 7.3 High · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-426
- [gitk can inadvertently call executables in the worktree](https://agentprime.io/advisories/CVE-2023-23618.md)
  `CVE-2023-23618` · CVE record: git-for-windows git · CVSS 8.6 High · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-426
- [Git's \`git apply\` overwriting paths outside the working tree](https://agentprime.io/advisories/CVE-2023-23946.md)
  `CVE-2023-23946` · CVE record: git git · CVSS 6.2 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: Path traversal
- [Git vulnerable to local clone-based data exfiltration with non-local transports](https://agentprime.io/advisories/CVE-2023-22490.md)
  `CVE-2023-22490` · CVE record: git git · CVSS 5.5 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: Path traversal
- [gitattributes parsing integer overflow in git](https://agentprime.io/advisories/CVE-2022-23521.md)
  `CVE-2022-23521` · CVE record: git git · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.56 · Not analysed yet · Published 17 Jan 2023 · Tags: Memory corruption
- [Integer overflow in \`git archive\`, \`git log --format\` leading to RCE in git](https://agentprime.io/advisories/CVE-2022-41903.md)
  `CVE-2022-41903` · CVE record: git git · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.44 · Not analysed yet · Published 17 Jan 2023 · Tags: Memory corruption
- [Git clone remote code execution vulnerability in git-for-windows](https://agentprime.io/advisories/CVE-2022-41953.md)
  `CVE-2022-41953` · CVE record: git-for-windows git · CVSS 8.6 High · Not analysed yet · Published 17 Jan 2023 · Tags: CWE-426
- [Git vulnerable to Remote Code Execution via Heap overflow in \`git shell\`](https://agentprime.io/advisories/CVE-2022-39260.md)
  `CVE-2022-39260` · CVE record: git git · CVSS 8.5 High · Not analysed yet · Published 19 Oct 2022 · Tags: Memory corruption
- [Git subject to exposure of sensitive information via local clone of symbolic links](https://agentprime.io/advisories/CVE-2022-39253.md)
  `CVE-2022-39253` · CVE record: git git · CVSS 5.5 Medium · Not analysed yet · Published 19 Oct 2022 · Tags: Information disclosure
- [Git for Windows' installer can be tricked into executing an untrusted binary](https://agentprime.io/advisories/CVE-2022-31012.md)
  `CVE-2022-31012` · CVE record: git-for-windows git · CVSS 8.2 High · Not analysed yet · Published 12 Jul 2022 · Tags: CWE-426
- [Bypass of safe.directory protections in Git](https://agentprime.io/advisories/CVE-2022-29187.md)
  `CVE-2022-29187` · CVE record: git git · CVSS 7.8 High · Not analysed yet · Published 12 Jul 2022 · Tags: CWE-282, CWE-427
- [Uncontrolled search for the Git directory in Git for Windows](https://agentprime.io/advisories/CVE-2022-24765.md)
  `CVE-2022-24765` · CVE record: git-for-windows git · CVSS 6.0 Medium · Not analysed yet · Published 12 Apr 2022 · Tags: CWE-427
- [malicious repositories can execute remote code while cloning](https://agentprime.io/advisories/CVE-2021-21300.md)
  `CVE-2021-21300` · CVE record: git git · CVSS 8.0 High · Critical (CVSS 7+ and EPSS) · EPSS 0.89 · Not analysed yet · Published 9 Mar 2021 · Tags: Path traversal
- [Malicious URLs can still cause Git to send a stored credential to the wrong server](https://agentprime.io/advisories/CVE-2020-11008.md)
  `CVE-2020-11008` · CVE record: git git · CVSS 4.0 Medium · Not analysed yet · Published 21 Apr 2020 · Tags: CWE-20
- [malicious URLs may cause Git to present stored credentials to the wrong server](https://agentprime.io/advisories/CVE-2020-5260.md)
  `CVE-2020-5260` · CVE record: git git · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 14 Apr 2020 · Tags: CWE-20

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=git>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/git/>. Everything for agents: <https://agentprime.io/llms.txt>.