High severity · published Aug 14, 2019
CVE-2019-1211
An elevation of privilege vulnerability exists in Git for Visual Studio when it improperly parses configuration files
7.3
CVSS
1.7%
EPSS
No
On KEV
Description
An elevation of privilege vulnerability exists in Git for Visual Studio when it improperly parses configuration files. An attacker who successfully exploited the vulnerability could execute code in the context of another local user.
To exploit the vulnerability, an authenticated attacker would need to modify Git configuration files on a system prior to a full installation of the application. The attacker would then need to convince another user on the system to execute specific Git commands.
The update addresses the issue by changing the permissions required to edit configuration files.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Visual Studio 2017 · Microsoft
15.9 · source: NVD
VS
Visual Studio 2019 · Microsoft
16.0; 16.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1211
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1211
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1211
More from Visual Studio 2017
7.8
CVE-2020-1147
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
9.8
CVE-2026-47304
.NET Security Feature Bypass Vulnerability
8.8
CVE-2025-49739
Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network
8.8
CVE-2025-21178
Visual Studio Remote Code Execution Vulnerability
8.8
CVE-2025-21176
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
