CVE-2017-17831: Arbitrary Command Execution in github.com/git-lfs/git-lfs
Summary
CVE-2017-17831: Arbitrary command execution in github.com/git-lfs/git-lfs. Affects github.com/git-lfs/git-lfs versions < 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible. Fixed in 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
github.com/git-lfs/git-lfs is a Go package that provides a Git extension for versioning large files. It allows users to store and manage large files efficiently in a Git repository. The package includes functionality for cloning repositories and handling Large File Storage (LFS).
Vulnerability Detail
Arbitrary command execution can be triggered by improperly sanitized SSH URLs in LFS configuration files. This vulnerability can be exploited when cloning a malicious repository. An attacker can craft a specially crafted SSH URL that, when processed by the git-lfs package, executes arbitrary commands on the host system. This can lead to unauthorized access, data leakage, or remote code execution.
How To Fix
Latest published version: v2.5.2+incompatible as of 23 Oct 2026
go get github.com/git-lfs/git-lfs@v2.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.1-0.20170519163204-f913f5f9c7c6+incompatible
This is the first release that contains the fix.
go get github.com/git-lfs/git-lfs@v2.1.1-0.20170519163204-f913f5f9c7c6+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the git-lfs package to the fixed version to mitigate the risk of arbitrary command execution.
Conclusion
Arbitrary command execution in github.com/git-lfs/git-lfs can be exploited by improperly sanitized SSH URLs in LFS configuration files. To mitigate this vulnerability, it is crucial to update the git-lfs package to version 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data leakage, or remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. It is crucial to update the git-lfs package to the fixed version to mitigate the risk.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly. However, it is important to update the git-lfs package to the fixed version to prevent potential exploitation.
You can find more information about this vulnerability in the Go Vulnerability Database at https://pkg.go.dev/vuln/GO-2021-0073.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
