Executive brief
Arbitrary code execution on Windows in github.com/git-lfs/git-lfs
Affected products
- Go github.com/git-lfs/git-lfs
Junglewise Threat Intelligence
CVE-2021-21237: GO-2021-0098 - Arbitrary code execution on Windows in github.com/git-lfs/git-lfs
CVE-2021-21237 · Severity: low · CVSS 3.1 · Published 2021-04-14
Technologies: github.com/git-lfs/git-lfs (Go). Vendors: Go.
Related threats
- Git LFS arbitrary file write via symbolic link traversal
- GO-2025-3390 - Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs
- Git LFS can execute a binary from the current directory on Windows
- Git LFS can execute a Git binary from the current directory
- GO-2021-0073 - Arbitrary command execution in github.com/git-lfs/git-lfs