Critical Vulnerability in Git Package: Execution of Malicious Scripts on Case-Insensitive File Systems

git Updated 02 Oct 2025

Summary

09/03/2021

Disclosed on

N/A

Severity

Yes i

Fix available

High

Severity

7.5

CVSS Score

ALPINE-CVE-2021-21300: Git is an open-source distributed revision control system. Affects git versions < 2.22.5-r0. Fixed in 2.22.5-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Git is an open-source distributed revision control system widely used for source code management in software development. It allows multiple developers to work on a project simultaneously, tracking changes and facilitating collaboration. The package is known for its speed, efficiency, and support for non-linear development workflows. However, certain versions of Git are vulnerable to a security issue that can lead to the execution of malicious scripts when repositories are cloned onto case-insensitive file systems like NTFS, HFS+, or APFS.

Vulnerability Detail

In affected versions of Git, a specially crafted repository containing symbolic links and files using a clean/smudge filter (such as Git LFS) may trigger the execution of scripts during the checkout process. This vulnerability arises from the way Git handles symbolic links on case-insensitive file systems, potentially allowing attackers to execute arbitrary code. The earliest impacted version is 2.14.2, and the vulnerability has a CVSS score of 7.5, indicating a high severity level. The issue has been patched in several versions released on March 9, 2021.

How To Fix

Minimum fixed version

2.22.5-r0

This is the first release that contains the fix.

sudo apk add --upgrade git

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a workaround, you can disable symbolic link support in Git by executing the following command: git config --global core.symlinks false. Additionally, ensure that no clean/smudge filters, such as Git LFS, are configured globally before cloning repositories.

Conclusion

The vulnerability in Git poses a significant risk, particularly for users operating on case-insensitive file systems. It is crucial to update to the latest patched versions to mitigate the risk of malicious script execution. Additionally, employing workarounds can provide temporary relief until an update can be performed.

See every vulnerability recorded for git →