VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/git-lfs/git-lfs: vulnerability history, versions and safety

github.com/git-lfs/git-lfs is a package in the Go ecosystem. Vulert records 10 vulnerabilities for it across 120 releases, from Apr 2021 to Oct 2025. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
10 vulnerabilities recorded C1 H4 U5
i
3 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
1 in the last 12 months

Most recent disclosure 30 Oct 2025.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/git-lfs/git-lfs vulnerabilities

Vulert verdict on github.com/git-lfs/git-lfs v2.5.2+incompatible i

Updated on 22 Oct 2026

Careful: 3 of the 10 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 68/100
  • Security Some issues to review
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Plan around the 3 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v2.5.2+incompatible — unaffected i
  • Vulnerabilities on record 10 over 4 years · 1 in the last year i
  • Latest disclosure 30 Oct 2025 i
  • Highest CVSS 9.8 i
  • With no published fix 3 i
  • Stars 14,556 i
  • OpenSSF scorecard 5/10 i
  • Last release 63 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/git-lfs/git-lfs, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.5.1-0.20210721154858-48ffab044a18 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721145515-7f81e7ca1279 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721134142-1c309b7f2daa 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721132851-6b5f740a00ed 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721132851-d4d8d68da161 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721132551-aa6cb2a6124b 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721035132-e1624ca68524 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721034342-946f6cc4a6cf 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721033539-461af6e0a4d2 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721032925-832be8daaa9d 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210721031925-0a08c3008783 21 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720202549-10a4826a1154 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-1321b82a7795 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-1c5c3173171e 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-25347c593edf 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-3e765ab08b81 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-691de511613c 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-a0190a60205b 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-a487e7c3b77b 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-eb558b476f8e 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191600-fd77fff7546a 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-1b72076964dd 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-31d3fb7ceeef 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-6a699a0a7878 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-73b33753c0db 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-898dc43d1df8 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-9c46a3828128 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-9ff6739b6b8b 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-a0998e88bad3 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-c033051a406f 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191559-c07c98a755c9 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720191540-594f8e386cce 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183912-b4544ca5bb44 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183910-0981842d2162 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183910-4a784c9efe98 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183910-ab94bbfa24e1 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183904-3e5172123e20 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183731-42e08e18b1d7 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183731-72f98bb0138f 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183731-a9edd9490553 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183731-affd5e9f1c9a 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183731-e9ffd5dc5c48 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183730-18c15dea193a 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183730-4e22609311c0 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210720183730-c3bed437a385 20 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210719161614-05f7e0c8b8ee 19 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181651-e6c9d1de195d 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181531-cca4977b2386 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181525-8c12e4802a66 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181209-608bc8d53efe 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181208-6bfbde868ad2 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181207-1e41bbffbb07 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181207-4b28e2e8211b 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181207-4c0e51ff7079 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181207-552f7073af74 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181207-72e55b49d028 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181207-bbd47fd9f031 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181206-13e780ca3c04 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181206-30f0a2acbdf1 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181206-58523d4f1e23 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181206-9d591d368234 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210714181206-efaf9a2d4263 14 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210701200311-38ae601d5db0 01 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210701173020-8842816d279c 01 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210701173003-9fad6ff488f4 01 Jul 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210618125210-502801373173 18 Jun 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210616213034-74c51fa88557 16 Jun 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210614175130-e0b315cb3746 14 Jun 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210611142141-136193345bab 11 Jun 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210602162020-373de0c03350 02 Jun 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210601125358-4da6d5f30c52 01 Jun 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210525173431-f4a84ac616c4 25 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210525173406-ba039e7af38e 25 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210525151321-8490bf31483a 25 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210524193157-06f6e4b7b789 24 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210519153959-c7c6901893c3 19 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210518220412-d61200285d8e 18 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210518145628-cadbbe7af310 18 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210517183539-0b7d80edf4a3 17 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210517183404-a9f6eb7215c9 17 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210517174141-d400725442db 17 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210517053447-4800c5e9882f 17 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210517052646-b386d39dee3b 17 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210517051915-bf6fbe779de8 17 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210517051547-08ce778338a7 17 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210517033304-cabd052b1938 17 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210510175031-07737f07ad4c 10 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210507185536-d4a737d3d381 07 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210503202052-68159d7f8357 03 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210503182711-a895def2ae90 03 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210502043104-47e10cd48b85 02 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210502043104-9c774cef385a 02 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210502043104-e983982d35c6 02 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210502043103-045117071c93 02 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210502043103-edc594e00659 02 May 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210430175332-df3e6a2d8ea3 30 Apr 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210430143606-a7f5200b9c4b 30 Apr 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210429181309-285f77d7c04d 29 Apr 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210428152813-4b7b27f3c6e4 28 Apr 2021 C1 H2 U3 MIT Yes Details →
v1.5.1-0.20210428133941-469935436214 28 Apr 2021 C1 H2 U3 MIT Yes Details →
v1.1.1-0.20210419193132-94245ec834c7 19 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210419193132-94245ec834c7 19 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210419192840-5e03aa8fcf0d 19 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210414182810-497fdce39767 14 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210414182717-e6fb649074f8 14 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210414151733-98d237138ffd 14 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210414151657-846d4972ed8d 14 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210414073922-8eb1b9d823e3 14 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210411205746-bc59f83228ae 11 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210411143744-cb5f0ba2ac5f 11 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210411143738-23376cc13145 11 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210411143732-f03b222f0ccc 11 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210409154534-4b8dbffbd782 09 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210409154503-f9da1826677e 09 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210409085627-c87c6af9e556 09 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210409085136-02b98e34a48e 09 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210408154220-c281ebff85e3 08 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210405175933-d59d2bbbf98b 05 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210404080424-c7d2a6b89eb9 04 Apr 2021 C1 H2 U3 — Yes Details →
v1.5.1-0.20210330180109-dc68f8afff17 30 Mar 2021 C1 H2 U3 — Yes Details →

The newest 120 of 7,290 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 3
  • 2022 3
  • 2025 4

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 1 of the 10 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/git-lfs/git-lfs

The 5 most severe of 10 vulnerabilities recorded for this package

Search all 10 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2020-27955: Git LFS Execution of Arbitrary Code 9.8 critical 2.12.1 11 Feb 2022
CVE-2017-17831: GitHub Git LFS Improper Input Validation vulnerability 8.8 high 2.1.1-0.20170519163204-f913f5f9c7c6 14 May 2022
CVE-2025-26625: Git LFS Arbitrary File Write Vulnerability 8.6 high 3.7.1 17 Oct 2025
Credential Exfiltration Vulnerability in Git LFS 8.5 high No fix published 14 Jan 2025
CVE-2021-21237: Git LFS Windows Arbitrary Code Execution 7.2 high 2.13.2 15 Feb 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/git-lfs/git-lfs

Is github.com/git-lfs/git-lfs safe to use?

Vulert records 10 vulnerabilities for github.com/git-lfs/git-lfs in Go: 1 critical, 4 high, 0 medium and 0 low, plus 5 not yet rated. 3 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/git-lfs/git-lfs's Vulert package health score?

Vulert scores github.com/git-lfs/git-lfs 68/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

How many vulnerabilities does github.com/git-lfs/git-lfs have?

10 vulnerabilities are recorded for github.com/git-lfs/git-lfs in the Go ecosystem: 1 critical, 4 high, 0 medium and 0 low, plus 5 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/git-lfs/git-lfs vulnerabilities disclosed?

1 vulnerability was recorded for github.com/git-lfs/git-lfs in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/git-lfs/git-lfs are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/git-lfs/git-lfs for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/git-lfs/git-lfs version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.