CVE-2022-24826: Git LFS Windows Binary Execution Vulnerability
Summary
CVE-2022-24826: Git LFS can execute a binary from the current directory on Windows. Affects github.com/git-lfs/git-lfs/v3 versions >= 3.0.0, < 3.1.3. Fixed in 3.1.3. How to fix ↓
Also tracked for
- git-lfs · Bitnami
The same CVE-2022-24826 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS is an open-source extension for Git that allows the versioning of large files. It provides a way to manage and store binary files efficiently. Git LFS operates on various platforms, including Windows. However, a vulnerability has been discovered in Git LFS on Windows systems that allows the execution of arbitrary code from the current directory. This vulnerability does not affect Unix systems.
Vulnerability Detail
The vulnerability arises when Git LFS interacts with a malicious repository containing a file with a ..exe extension and a file named git.exe. If the git.exe file is not found in the system's PATH, the ..exe program will be executed instead, enabling an attacker to run arbitrary code. Similarly, if the repository contains files named ..exe and cygpath.exe, and cygpath.exe is not found in PATH, the ..exe program will be executed when certain Git LFS commands are run. This vulnerability is due to a bug in the Go os/exec package, which Git LFS uses to execute programs. The bug causes the package to prepend the current working directory to an empty string, resulting in the unintended execution of the ..exe file. The impact of this vulnerability is significant as it allows an attacker to execute arbitrary code on the affected Windows system.
How To Fix
Latest published version: v3.8.1 as of 23 Oct 2026
go get github.com/git-lfs/git-lfs/v3@v3.8.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.3
This is the first release that contains the fix.
go get github.com/git-lfs/git-lfs/v3@v3.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability at this time.
Conclusion
The Git LFS Windows Binary Execution Vulnerability (CVE-2022-24826) allows an attacker to execute arbitrary code on Windows systems running affected versions of Git LFS. It is crucial to upgrade to Git LFS version 3.1.4 to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/git-lfs/git-lfs/v3 →
FAQ
Git LFS is an open-source extension for Git that allows the versioning of large files.
This vulnerability affects Windows systems. Unix systems are not affected.
The vulnerability allows an attacker to execute arbitrary code on the affected Windows system.
Upgrade to Git LFS version 3.1.4 to fix this vulnerability.
There are no known workarounds for this vulnerability at this time.
