git for windows project git for windows vulnerabilities

Latest git for windows project git for windows CVEs

Newest publication first

1. CVE-2023-29012 Git CMD erroneously executes `doskey.exe` in the current directory, if it exists

   Published 2023-04-25

   High·CVSS 7.8 EPSS 0.38%

   Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed doskey.exe would be executed silently upon running Git CM...

2. CVE-2023-29011 Git for Windows's config file of `connect.exe` is susceptible to malicious placing

   Published 2023-04-25

   High·CVSS 7.8 EPSS 0.38%

   Git for Windows, the Windows port of Git, ships with an executable called connect.exe, which implements a SOCKS5 proxy that can be used to connect e.g. to SSH servers via proxies when certain ports are blocked for outgoing connections. The location of connect.exe's config file is...

3. CVE-2023-25815 Git looks for localized messages in the wrong place

   Published 2023-04-25

   Low·CVSS 2.2 EPSS 0.84%

   In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the gettext() function's implici...

4. CVE-2023-22743 Git for Windows' installer is susceptible to DLL side loading attacks

   Published 2023-02-14

   High·CVSS 7.3 EPSS 0.35%

   Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading sai...

5. CVE-2023-23618 gitk can inadvertently call executables in the worktree

   Published 2023-02-14

   High·CVSS 7.8 EPSS 0.39%

   Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when gitk is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick use...

6. CVE-2022-24767 GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.

   Published 2022-04-12

   High·CVSS 7.8 EPSS 1.5%

   GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.

7. CVE-2016-9274 Untrusted search path vulnerability in Git 1.x for Windows allows local users to gain privileges via a Trojan horse git.exe file in the current working directory. NOTE: 2.x is unaffected.

   Published 2016-11-11

   High·CVSS 7.8 EPSS 0.90%

   Untrusted search path vulnerability in Git 1.x for Windows allows local users to gain privileges via a Trojan horse git.exe file in the current working directory. NOTE: 2.x is unaffected.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.