CVE-2020-27955: Git LFS Execution of Arbitrary Code
Summary
CVE-2020-27955: Git LFS can execute a Git binary from the current directory. Affects github.com/git-lfs/git-lfs versions < 2.12.1. Fixed in 2.12.1. How to fix ↓
Also tracked for
- git-lfs · Bitnami
The same CVE-2020-27955 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS is a Git extension that allows the storage and management of large files. It is written in Go and primarily used on Windows systems. Git LFS operates on repositories and can execute Git binaries. However, a vulnerability in Git LFS allows the execution of a malicious git.bat or git.exe file from the current directory on Windows systems. This can lead to the execution of arbitrary code by an attacker. Unix systems are not affected by this vulnerability.
Vulnerability Detail
The vulnerability in Git LFS arises from the behavior of Go on Windows systems. When a command is run without a directory separator, Go includes and prefers the current directory. This means that if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program will be executed. As a result, an attacker can exploit this vulnerability to execute arbitrary code on the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: v2.5.2+incompatible as of 23 Oct 2026
go get github.com/git-lfs/git-lfs@v2.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.12.1
This is the first release that contains the fix.
go get github.com/git-lfs/git-lfs@v2.12.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Unfortunately, there is no known workaround for this vulnerability other than avoiding untrusted repositories. It is crucial to exercise caution when interacting with repositories that may contain malicious files.
Conclusion
The vulnerability in Git LFS allows the execution of arbitrary code on Windows systems. To mitigate this risk, it is crucial to update Git LFS to version 2.12.1 or later, which includes a patch for this vulnerability. Additionally, exercising caution when interacting with untrusted repositories is advised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
Git LFS is a Git extension that enables the storage and management of large files. It is commonly used to handle binary files, such as media assets, in Git repositories.
This vulnerability affects Windows systems. Unix systems are not impacted.
The vulnerability allows an attacker to execute arbitrary code on a Windows system by exploiting a malicious git.bat or git.exe file in the current directory. This can lead to unauthorized access, data manipulation, and other malicious activities.
No, there are no known workarounds for this vulnerability. It is recommended to update Git LFS to the patched version to mitigate the risk.
To update Git LFS, you can follow the official documentation provided by the Git LFS project. It typically involves running a command to update the Git LFS binary to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
