Vulnerabilities matching "github.com/git-lfs/git-lfs" — 11 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
Unrated CVE-2025-26625: Git LFS Arbitrary File Write Vulnerability via Crafted Symlinks github.com/git-lfs/git-lfs Go 30 Oct 2025 No fix published
8.6 high CVE-2025-26625: Git LFS Arbitrary File Write Vulnerability github.com/git-lfs/git-lfs Go 17 Oct 2025 3.7.1
Unrated CVE-2024-53263: Git LFS Credential Exfiltration via Crafted HTTP URLs github.com/git-lfs/git-lfs Go 15 Jan 2025 No fix published
8.5 high Credential Exfiltration Vulnerability in Git LFS github.com/git-lfs/git-lfs Go 14 Jan 2025 No fix published
8.8 high CVE-2017-17831: GitHub Git LFS Improper Input Validation vulnerability github.com/git-lfs/git-lfs Go 14 May 2022 2.1.1-0.20170519163204-f913f5f9c7c6
9.8 critical CVE-2022-24826: Git LFS Windows Binary Execution Vulnerability github.com/git-lfs/git-lfs/v3 Go 22 Apr 2022 3.1.3
7.2 high CVE-2021-21237: Git LFS Windows Arbitrary Code Execution github.com/git-lfs/git-lfs Go 15 Feb 2022 2.13.2
9.8 critical CVE-2020-27955: Git LFS Execution of Arbitrary Code github.com/git-lfs/git-lfs Go 11 Feb 2022 2.12.1
Unrated CVE-2021-21237: Git LFS Windows Arbitrary Code Execution github.com/git-lfs/git-lfs Go 14 Apr 2021 1.5.1-0.20210113180018-fc664697ed2c
Unrated CVE-2017-17831: Arbitrary Command Execution in github.com/git-lfs/git-lfs github.com/git-lfs/git-lfs Go 14 Apr 2021 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible
Unrated CVE-2021-21237: Arbitrary code execution on Windows in github.com/git-lfs/git-lfs github.com/git-lfs/git-lfs Go 14 Apr 2021 1.5.1-0.20210113180018-fc664697ed2c
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.