cbl-mariner git vulnerabilities

Latest cbl-mariner git CVEs

Newest publication first

1. CVE-2025-66413 Git for Windows leaks NTLM hash when cloning from an attacker-controlled server

   Published 2026-03-10

   Medium·CVSS 6.5 EPSS 0.32%

   Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This...

2. CVE-2024-52005 The sideband payload is passed unfiltered to the terminal in git

   Published 2025-01-15

   High·CVSS 7.5 EPSS 0.51%

   Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed d...

3. CVE-2024-50349 Git does not sanitize URLs when asking for credentials interactively

   Published 2025-01-14

   Low·CVSS 2.1 EPSS 0.65%

   Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the...

4. CVE-2024-52006 Newline confusion in credential helpers can lead to credential exfiltration in git

   Published 2025-01-14

   Low·CVSS 2.1 EPSS 1.0%

   Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. So...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.