CVE-2021-21237: Git LFS Windows Arbitrary Code Execution
Summary
CVE-2021-21237: Git LFS can execute a Git binary from the current directory on Windows. Affects github.com/git-lfs/git-lfs versions < 2.13.2. Fixed in 2.13.2. How to fix ↓
Also tracked for
- git-lfs · Bitnami
The same CVE-2021-21237 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Git LFS is a Git extension that allows the versioning of large files. It is written in Go and primarily used for managing large files in Git repositories. Git LFS operates on both Windows and Unix systems. However, this vulnerability specifically affects the Windows version of Git LFS. The vulnerability allows an attacker to execute arbitrary code by exploiting a flaw in the handling of Git binaries in the current directory on Windows systems. This vulnerability is a result of an incomplete fix for a previous vulnerability (CVE-2020-27955).
Vulnerability Detail
On Windows systems, if Git LFS operates on a malicious repository that contains a git.bat or git.exe file in the current directory, the program would be executed, enabling the attacker to execute arbitrary code. This vulnerability does not affect Unix systems. The issue arises because Go includes and prefers the current directory when the name of a command run does not contain a directory separator. The impact of this vulnerability is significant as it allows an attacker to execute arbitrary code on the target system, potentially leading to further compromise or unauthorized access.
How To Fix
Latest published version: v2.5.2+incompatible as of 23 Oct 2026
go get github.com/git-lfs/git-lfs@v2.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.13.2
This is the first release that contains the fix.
go get github.com/git-lfs/git-lfs@v2.13.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Unfortunately, there are no effective workarounds for this vulnerability other than avoiding untrusted repositories or using a different operating system. It is crucial to exercise caution when interacting with Git repositories, especially those from unknown or untrusted sources.
Conclusion
The vulnerability in Git LFS on Windows systems allows for the execution of arbitrary code, posing a significant risk to the security and integrity of affected systems. To mitigate this risk, it is crucial to update Git LFS to version 2.13.2 or later. Additionally, exercising caution when interacting with Git repositories, especially those from unknown or untrusted sources, is highly recommended. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
Git LFS (Large File Storage) is a Git extension that allows the versioning of large files in Git repositories. It provides a way to manage and store large files efficiently while still utilizing the benefits of Git for version control.
This vulnerability specifically affects the Windows version of Git LFS. Unix systems are not impacted by this particular issue.
The vulnerability allows an attacker to execute arbitrary code on a Windows system where Git LFS is installed. This can lead to further compromise, unauthorized access, or other malicious activities.
Yes, a patch is available in Git LFS version 2.13.2. Users should update their Git LFS installation to this version or later to mitigate the risk of exploitation.
Unfortunately, there are no effective workarounds for this vulnerability other than avoiding untrusted repositories or using a different operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
