CVE-2022-24826

CVE-2022-24826 is a critical vulnerability affecting Git LFS on Windows, specifically versions 2.12.1 through 3.1.2. It allows for arbitrary code execution if a user operates on a malicious repository containing specially crafted files (e.g., "..exe" and a legitimate program like "git.exe") and the legitimate program is not found in the system's PATH. This occurs due to a bug in the Go os/exec package when Git LFS attempts to execute programs not found in PATH. The vulnerability carries a CVSS score of 7.8 (HIGH), indicating a significant risk. It requires user interaction (UI:R) to clone or operate on a malicious repository, but once triggered, it can lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected Windows system. The attack complexity is low (AC:L), as it leverages a specific behavior in the Go os/exec package. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention. Users are strongly advised to upgrade to Git LFS version 3.1.3 to mitigate this risk.