Executive brief
Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs
Affected products
- Go github.com/git-lfs/git-lfs/v3
- Go github.com/git-lfs/git-lfs
Junglewise Threat Intelligence
CVE-2024-53263: GO-2025-3390 - Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs
CVE-2024-53263 · Severity: medium · CVSS 4 · Published 2025-01-15
Technologies: github.com/git-lfs/git-lfs/v3 (Go), github.com/git-lfs/git-lfs (Go). Vendors: Go.
Related threats
- Git LFS arbitrary file write via symbolic link traversal
- Git LFS can execute a binary from the current directory on Windows
- Git LFS can execute a Git binary from the current directory
- GO-2021-0098 - Arbitrary code execution on Windows in github.com/git-lfs/git-lfs
- GO-2021-0073 - Arbitrary command execution in github.com/git-lfs/git-lfs