Executive brief
Git LFS can execute a binary from the current directory on Windows
Affected products
- Go github.com/git-lfs/git-lfs/v3
- Go github.com/git-lfs/git-lfs
Junglewise Threat Intelligence
CVE-2022-24826: Git LFS can execute a binary from the current directory on Windows
CVE-2022-24826 · Severity: low · CVSS 3.1 · Published 2022-04-22
Technologies: github.com/git-lfs/git-lfs/v3 (Go), github.com/git-lfs/git-lfs (Go). Vendors: Go.
Related threats
- Git LFS arbitrary file write via symbolic link traversal
- GO-2025-3390 - Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs
- Git LFS can execute a Git binary from the current directory
- GO-2021-0098 - Arbitrary code execution on Windows in github.com/git-lfs/git-lfs
- GO-2021-0073 - Arbitrary command execution in github.com/git-lfs/git-lfs