Login Request a demo
GI
Product
Git
by Git-scm · last CVE Jul 8, 2025
On CISA KEVExploited in the wild
41
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities41In the news0Timeline
Severity mix
Critical 8High 23Medium 4Low 2
Severity
All severities41Critical8High23Medium4Low2
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Git to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-48384
In wildKEV
8.0
4%
Jul 8
Git allows arbitrary code execution through broken config quoting
Affected: before 2.43.7; 2.44.0 before 2.44.4; 2.45.0 before 2.45.4; 2.46.0 before 2.46.4; 2.47.0 before 2.47.3; 2.48.0 before 2.48.2; +2 more
CVE-2022-41903
9.8
44%
Jan 17
Git is distributed revision control system
Affected: through 2.30.6; 2.31.0 through 2.31.5; 2.32.0 through 2.32.4; 2.33.0 through 2.33.5; 2.34.0 through 2.34.5; 2.35.0 through 2.35.5; +4 more
CVE-2022-23521
9.8
56%
Jan 17
Git is distributed revision control system
Affected: through 2.30.6; 2.31.0 through 2.31.5; 2.32.0 through 2.32.4; 2.33.0 through 2.33.5; 2.34.0 through 2.34.5; 2.35.0 through 2.35.5; +4 more
CVE-2014-9390
9.8
76%
Feb 12
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode…
Affected: before 1.8.5.6; 1.9.0 before 1.9.5; 2.0.0 before 2.0.5; 2.1.0 before 2.1.4; 2.2.0 before 2.2.1
CVE-2019-1353
9.8
2%
Jan 24
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6
Affected: 2.14.0 before 2.14.6; 2.15.0 before 2.15.4; 2.16.0 before 2.16.6; 2.17.0 before 2.17.3; 2.18.0 before 2.18.2; 2.19.0 before 2.19.3; +5 more
CVE-2018-19486
9.8
4%
Nov 23
Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and…
Affected: before 2.19.2
CVE-2018-17456
9.8
97%
Oct 6
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing…
Affected: 2.14.0 before 2.14.5; 2.15.0 before 2.15.3; 2.16.0 before 2.16.5; 2.17.0 before 2.17.2; 2.18.0 before 2.18.1; 2.19.0 before 2.19.1
CVE-2016-2324
9.8
18%
Apr 8
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer…
Affected: through 2.7.3
CVE-2016-2315
9.8
17%
Apr 8
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees,…
Affected: 2.7.3
CVE-2022-39260
8.8
4%
Oct 19
Git vulnerable to Remote Code Execution via Heap overflow in `git shell`
Affected: before 2.30.6; 2.31.0 before 2.31.5; 2.32.0 before 2.32.4; 2.33.0 before 2.33.5; 2.34.0 before 2.34.5; 2.35.0 before 2.35.5; +3 more
CVE-2019-1387
8.8
4%
Dec 18
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6
Affected: 2.14.0 before 2.14.6; 2.15.0 before 2.15.4; 2.16.0 before 2.16.6; 2.17.0 before 2.17.3; 2.18.0 before 2.18.2; 2.19.0 before 2.19.3; +5 more
CVE-2017-1000117
8.8
78%
Oct 5
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine…
Affected: through 2.7.5; 2.8.0; 2.8.0; 2.8.0; 2.8.0; 2.8.0; +34 more
CVE-2017-14867
8.8
36%
Sep 29
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver,…
Affected: through 2.10.4; 2.11.0; 2.11.1; 2.11.2; 2.11.3; 2.12.0; +12 more
CVE-2014-9938
8.8
2%
Mar 20
contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution
Affected: before 1.9.3
CVE-2024-32465
7.8
1%
May 14
Git is a revision control system
Affected: before 2.39.4; 2.40.0 before 2.40.2; 2.42.0 before 2.42.2; 2.43.0 before 2.43.4; 2.41.0; 2.44.0; +1 more
CVE-2024-32004
7.8
1%
May 14
Git is a revision control system
Affected: before 2.39.4; 2.40.0 before 2.40.2; 2.42.0 before 2.42.2; 2.43.0 before 2.43.4; 2.41.0; 2.44.0; +1 more
CVE-2023-29007
7.8
6%
Apr 25
Git is a revision control system
Affected: before 2.30.9; 2.31.0 before 2.31.8; 2.32.0 before 2.32.7; 2.33.0 before 2.33.8; 2.34.0 before 2.34.8; 2.35.0 before 2.35.8; +5 more
CVE-2022-41953
7.8
7%
Jan 17
Git GUI is a convenient graphical tool that comes with Git for Windows
Affected: before 2.39.1
CVE-2022-29187
7.8
0%
Jul 12
Git is a distributed revision control system
Affected: 2.30.3 before 2.30.5; 2.31.2 before 2.31.4; 2.32.1 before 2.32.3; 2.33.2 before 2.33.4; 2.34.2 before 2.34.4; 2.35.2 before 2.35.4; +2 more
CVE-2022-24765
7.8
1%
Apr 12
Git for Windows is a fork of Git containing Windows-specific patches
Affected: before 2.35.2
CVE-2019-19604
7.8
4%
Dec 11
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule…
Affected: before 2.20.0; 2.21.0 before 2.21.1; 2.22.0 before 2.22.2; 2.23.0 before 2.23.1; 2.24.0 before 2.24.1
CVE-2018-11235
7.8
48%
May 30
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur
Affected: through 2.13.6; 2.14.0 through 2.14.3; 2.15.0 through 2.15.1; 2.16.0 through 2.16.3; 2.17.0
CVE-2023-25652
7.5
52%
Apr 25
Git is a revision control system
Affected: before 2.30.9; 2.31.0 before 2.31.8; 2.32.0 before 2.32.7; 2.33.0 before 2.33.8; 2.34.0 before 2.34.8; 2.35.0 before 2.35.8; +5 more
CVE-2023-23946
7.5
1%
Feb 14
Git's `git apply` overwriting paths outside the working tree
Affected: before 2.30.8; 2.31.0 before 2.31.7; 2.32.0 before 2.32.6; 2.33.0 before 2.33.7; 2.34.0 before 2.34.7; 2.35.0 before 2.35.7; +4 more
CVE-2022-24975
7.5
3%
Feb 11
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue
Affected: through 2.35.1
CVE-2021-40330
7.5
3%
Aug 31
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated…
Affected: before 2.30.1
CVE-2021-21300
7.5
89%
Mar 9
Git is an open-source distributed revision control system
Affected: through 2.14.2; 2.17.0 before 2.17.6; 2.18.0 before 2.18.5; 2.19.0 before 2.19.6; 2.20.0 before 2.20.5; 2.21.0 before 2.21.4; +9 more
CVE-2020-11008
7.5
4%
Apr 21
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker
Affected: before 2.17.5; 2.18.0 before 2.18.4; 2.19.0 before 2.19.5; 2.20.0 before 2.20.4; 2.21.0 before 2.21.3; 2.22.0 before 2.22.4; +4 more
CVE-2020-5260
7.5
10%
Apr 14
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker
Affected: 2.18.0 before 2.18.3; 2.19.0 before 2.19.4; 2.20.0 before 2.20.3; 2.21.0 before 2.21.2; 2.23.0 before 2.23.2; 2.24.0 before 2.24.2; +2 more
CVE-2018-11233
7.5
4%
May 30
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading…
Affected: through 2.13.6; 2.14.0 through 2.14.3; 2.15.0 through 2.15.1; 2.16.0 through 2.16.3; 2.17.0
CVE-2024-32021
7.1
1%
May 14
Git is a revision control system
Affected: before 2.39.4; 2.40.0 before 2.40.2; 2.42.0 before 2.42.2; 2.43.0 before 2.43.4; 2.41.0; 2.44.0; +1 more
CVE-2023-22490
5.5
1%
Feb 14
Git vulnerable to local clone-based data exfiltration with non-local transports
Affected: before 2.30.8; 2.31.0 before 2.31.7; 2.32.0 before 2.32.6; 2.33.0 before 2.33.7; 2.34.0 before 2.34.7; 2.35.0 before 2.35.7; +4 more
CVE-2022-39253
5.5
1%
Oct 19
Git subject to exposure of sensitive information via local clone of symbolic links
Affected: before 2.30.6; 2.31.0 before 2.31.5; 2.32.0 before 2.32.4; 2.33.0 before 2.33.5; 2.34.0 before 2.34.5; 2.35.0 before 2.35.5; +3 more
CVE-2017-15298
5.5
2%
Oct 14
Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb
Affected: through 2.14.2
CVE-2018-1000021
5.0
1%
Feb 9
GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE
Affected: through 2.15.1
CVE-2024-32020
3.3
1%
May 14
Git is a revision control system
Affected: before 2.39.4; 2.40.0 before 2.40.2; 2.42.0 before 2.42.2; 2.43.0 before 2.43.4; 2.41.0; 2.44.0; +1 more
CVE-2019-1348
3.3
0%
Jan 24
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6
Affected: 2.14.0 before 2.14.6; 2.15.0 before 2.15.4; 2.16.0 before 2.16.6; 2.17.0 before 2.17.3; 2.18.0 before 2.18.2; 2.19.0 before 2.19.3; +5 more
CVE-2013-0308
–
2%
Mar 8
The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
Affected: through 1.8.1.3
CVE-2010-3906
–
6%
Dec 17
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters
Affected: through 1.7.3.3; 0.01; 0.02; 0.03; 0.04; 0.5; +2 more
CVE-2010-2542
–
3%
Aug 11
Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a…
Affected: before 1.7.2.1
CVE-2008-5516
–
4%
Jan 20
The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search
Affected: 0.6.0; 0.7.0
Showing 41