CVE-2017-17831: GitHub Git LFS Improper Input Validation vulnerability
Summary
CVE-2017-17831: GitHub Git LFS Arbitrary command execution vulnerability. Affects github.com/git-lfs/git-lfs versions < 2.1.1-0.20170519163204-f913f5f9c7c6. Fixed in 2.1.1-0.20170519163204-f913f5f9c7c6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub Git LFS is a tool that allows large files to be stored in a Git repository by replacing them with text pointers. It is written in Go and provides an extension for Git. The vulnerability in question affects versions of GitHub Git LFS prior to 2.1.1. This vulnerability allows remote attackers to execute arbitrary commands by exploiting improper input validation. Specifically, an attacker can use an ssh URL with an initial dash character in the hostname, which is located on a url = line in a .lfsconfig file within a repository.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation in GitHub Git LFS. By crafting a malicious ssh URL with an initial dash character in the hostname, an attacker can trick the system into executing arbitrary commands. This can lead to various consequences, including unauthorized access, data manipulation, and remote code execution. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: v2.5.2+incompatible as of 23 Oct 2026
go get github.com/git-lfs/git-lfs@v2.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.1-0.20170519163204-f913f5f9c7c6
This is the first release that contains the fix.
go get github.com/git-lfs/git-lfs@v2.1.1-0.20170519163204-f913f5f9c7c6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The GitHub Git LFS Improper Input Validation vulnerability (CVE-2017-17831) allows remote attackers to execute arbitrary commands. It is crucial to update GitHub Git LFS to version 2.1.1 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
GitHub Git LFS is a tool that allows large files to be stored in a Git repository by replacing them with text pointers.
This vulnerability allows remote attackers to execute arbitrary commands, potentially leading to unauthorized access, data manipulation, and remote code execution.
To fix this vulnerability, update GitHub Git LFS to version 2.1.1 or later by following the official documentation.
No, there is no known workaround. It is essential to update to the fixed version.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
