CVE-2021-21237: Git LFS Windows Arbitrary Code Execution
Summary
CVE-2021-21237: Arbitrary code execution on Windows in github.com/git-lfs/git-lfs. Affects github.com/git-lfs/git-lfs versions < 1.5.1-0.20210113180018-fc664697ed2c. Fixed in 1.5.1-0.20210113180018-fc664697ed2c. How to fix ↓
Also tracked for
- git-lfs · Bitnami
The same CVE-2021-21237 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS is a Git extension that allows the versioning of large files. It is written in Go and is primarily used for managing binary files in Git repositories. Git LFS operates on both Unix and Windows systems. However, on Windows, there is a vulnerability that allows the execution of a Git binary from the current directory. This vulnerability does not affect Unix systems. The issue arises due to an incomplete fix for a previous vulnerability (CVE-2020-27955).
Vulnerability Detail
On Windows, if Git LFS interacts with a malicious repository containing a git.bat or git.exe file in the current directory, the program will be executed, enabling the attacker to run arbitrary code. This can lead to unauthorized access, data manipulation, or system compromise. The vulnerability stems from Go's behavior on Windows, where it includes and prefers the current directory when the name of a command does not contain a directory separator. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2.
How To Fix
Latest published version: v2.5.2+incompatible as of 23 Oct 2026
go get github.com/git-lfs/git-lfs@v2.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.1-0.20210113180018-fc664697ed2c
This is the first release that contains the fix.
go get github.com/git-lfs/git-lfs@v1.5.1-0.20210113180018-fc664697ed2cTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Unfortunately, there are no effective workarounds for this vulnerability other than avoiding untrusted repositories or using a different operating system. It is crucial to exercise caution when interacting with Git repositories and only use trusted sources.
Conclusion
The vulnerability in Git LFS on Windows systems allows the execution of arbitrary code, posing a significant security risk. It is crucial to update Git LFS to version 2.13.2 or later to mitigate this vulnerability. Users should exercise caution when interacting with Git repositories and only use trusted sources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
Git LFS (Large File Storage) is a Git extension that allows the versioning of large files in Git repositories. It is primarily used for managing binary files.
This vulnerability affects Git LFS installations on Windows systems. Unix systems are not impacted.
The vulnerability allows the execution of arbitrary code, which can lead to unauthorized access, data manipulation, or system compromise.
Yes, the vulnerability has been patched in Git LFS version 2.13.2. It is recommended to update to this version or later to mitigate the risk.
Unfortunately, there are no effective workarounds for this vulnerability other than avoiding untrusted repositories or using a different operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
