Executive brief
Git LFS can execute a Git binary from the current directory
Affected products
- Go github.com/git-lfs/git-lfs
Junglewise Threat Intelligence
CVE-2020-27955: Git LFS can execute a Git binary from the current directory
CVE-2020-27955 · Severity: low · CVSS 3.1 · Published 2022-02-11
Technologies: github.com/git-lfs/git-lfs (Go). Vendors: Go.
Related threats
- Git LFS arbitrary file write via symbolic link traversal
- GO-2025-3390 - Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs
- Git LFS can execute a binary from the current directory on Windows
- GO-2021-0098 - Arbitrary code execution on Windows in github.com/git-lfs/git-lfs
- GO-2021-0073 - Arbitrary command execution in github.com/git-lfs/git-lfs