Login Request a demo
GI
Product
git
by git · last CVE Jul 8, 2025
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities24In the news0Timeline
Severity mix
Critical 2High 10Medium 4Low 1
Severity
All severities24Critical2High10Medium4Low1
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add git to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-48384
In wildKEV
8.0
4%
Jul 8
Git allows arbitrary code execution through broken config quoting
Affected: < 2.43.7; >= 2.44.0-rc0, < 2.44.4; >= 2.45.0-rc0, < 2.45.4; >= 2.46.0-rc0, < 2.46.4; >= 2.47.0-rc0, < 2.47.3; >= 2.48.0-rc0, < 2.48.2; +2 more
CVE-2022-25648
9.8
5%
Apr 19
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection
Affected: before 1.11.0
CVE-2024-32002
9.0
29%
May 14
Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
Affected: = 2.45.0; = 2.44.0; >= 2.43.0, < 2.43.4; >= 2.42.0, < 2.42.2; = 2.41.0; >= 2.40.0, < 2.40.2; +1 more
CVE-2024-52005
8.8
1%
Jan 15
The sideband payload is passed unfiltered to the terminal in git
Affected: >= 2.48.0, <= 2.48.1; >= 2.47.0, <= 2.47.1; >= 2.46.0, <= 2.46.3; >= 2.45.0, <= 2.45.3; >= 2.44.0, <= 2.44.3; >= 2.43.0, <= 2.43.6; +3 more
CVE-2022-39260
8.8
4%
Oct 19
Git vulnerable to Remote Code Execution via Heap overflow in `git shell`
Affected: < 2.30.6; > 2.31.0, < 2.31.5; > 2.32.0, < 2.32.4; > 2.33.0, < 2.33.5; > 2.34.0, < 2.34.5; > 2.34.0, < 2.35.5; +2 more
CVE-2025-48385
8.6
1%
Jul 8
Git alllows arbitrary file writes via bundle-uri parameter injection
Affected: < 2.43.7; >= 2.44.0-rc0, < 2.44.4; >= 2.45.0-rc0, < 2.45.4; >= 2.46.0-rc0, < 2.46.4; >= 2.47.0-rc0, < 2.47.3; >= 2.48.0-rc0, < 2.48.2; +2 more
CVE-2024-32465
7.8
1%
May 14
Git's protections for cloning untrusted repositories can be bypassed
Affected: = 2.45.0; = 2.44.0; >= 2.43.0, < 2.43.4; >= 2.42.0, < 2.42.2; = 2.41.0; >= 2.40.0, < 2.40.2; +1 more
CVE-2024-32004
7.8
1%
May 14
Git vulnerable to Remote Code Execution while cloning special-crafted local repositories
Affected: = 2.45.0; = 2.44.0; >= 2.43.0, < 2.43.4; >= 2.42.0, < 2.42.2; = 2.41.0; >= 2.40.0, < 2.40.2; +1 more
CVE-2024-52006
7.5
1%
Jan 14
Newline confusion in credential helpers can lead to credential exfiltration in git
Affected: <= 2.40.3; >= 2.41.0, <= 2.41.2; >= 2.42.0, <= 2.42.3; >= 2.43.0, <= 2.43.5; >= 2.44.0, <= 2.44.2; >= 2.45.0, <= 2.45.2; +3 more
CVE-2023-23946
7.5
1%
Feb 14
Git's `git apply` overwriting paths outside the working tree
Affected: >= 2.39.0, < 2.39.2; >= 2.38.0, < 2.38.4; >= 2.37.0, < 2.37.6; >= 2.36.0, < 2.36.5; >= 2.35.0, < 2.35.7; >= 2.34.0, < 2.34.7; +4 more
CVE-2020-5260
7.5
10%
Apr 14
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker
Affected: before 2.17.4; 2.22.0 before 2.22.3
CVE-2024-32021
7.1
1%
May 14
Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory
Affected: = 2.45.0; = 2.44.0; >= 2.43.0, < 2.43.4; >= 2.42.0, < 2.42.2; = 2.41.0; >= 2.40.0, < 2.40.2; +1 more
CVE-2025-48386
6.3
0%
Jul 8
Git allows a buffer overflow in 'wincred' credential helper
Affected: < 2.43.7; >= 2.44.0-rc0, < 2.44.4; >= 2.45.0-rc0, < 2.45.4; >= 2.46.0-rc0, < 2.46.4; >= 2.47.0-rc0, < 2.47.3; >= 2.48.0-rc0, < 2.48.2; +2 more
CVE-2023-22490
5.5
1%
Feb 14
Git vulnerable to local clone-based data exfiltration with non-local transports
Affected: >= 2.39.0, < 2.39.2; >= 2.38.0, < 2.38.4; >= 2.37.0, < 2.37.6; >= 2.36.0, < 2.36.5; >= 2.35.0, < 2.35.7; >= 2.34.0, < 2.34.7; +4 more
CVE-2022-39253
5.5
1%
Oct 19
Git subject to exposure of sensitive information via local clone of symbolic links
Affected: < 2.30.6; < 2.31.5; < 2.32.4; < 2.33.5; < 2.34.5; < 2.35.5; +2 more
CVE-2024-50349
4.7
1%
Jan 14
Git does not sanitize URLs when asking for credentials interactively
Affected: <= 2.40.3; >= 2.41.0, <= 2.41.2; >= 2.42.0, <= 2.42.3; >= 2.43.0, <= 2.43.5; >= 2.44.0, <= 2.44.2; >= 2.45.0, <= 2.45.2; +3 more
CVE-2024-32020
3.3
1%
May 14
Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will
Affected: = 2.45.0; = 2.44.0; >= 2.43.0, < 2.43.4; >= 2.42.0, < 2.42.2; = 2.41.0; >= 2.40.0, < 2.40.2; +1 more
CVE-2010-3906
–
6%
Dec 17
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters
Affected: 0.99.9j; 0.99.9k; 0.99.9l; 0.99.9m; 0.99.9n; 1.0.0; +34 more
CVE-2009-2108
–
6%
Jun 18
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized…
Affected: 1.4.4.5; 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0.1; +34 more
CVE-2008-5916
–
0%
Jan 21
gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local…
Affected: 1.4.3.1; 1.4.3.2; 1.4.3.3; 1.4.3.4; 1.4.3.5; 1.4.4; +34 more
CVE-2008-5516
–
4%
Jan 20
The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search
Affected: 0.99.9j; 0.99.9k; 0.99.9l; 0.99.9m; 0.99.9n; 1.0.0; +34 more
CVE-2008-5517
–
12%
Jan 13
The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object
Affected: 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0.1; 1.5.0.2; +34 more
CVE-2008-3546
–
4%
Aug 7
Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length…
Affected: 1.5.5.3; 1.5.5.3; 1.5.5.4; 1.5.6.1; 1.5.6.2; 1.5.6.3
CVE-2006-0477
–
3%
Jan 31
Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link
Affected: 1.0.0; 1.0.0b; 1.0.3; 1.0.4; 1.0.5; 1.0.6; +7 more
Showing 24