Git's vulnerability footprint centers on a widely deployed distributed version-control system that serves as foundational infrastructure across development environments and continuous-integration pipelines. Vulnerabilities affecting the vendor skew toward serious outcomes, frequently acquire public exploit code, and recur through encoding and injection-oriented weakness classes including improper output escaping, code injection, and input validation failures that reflect the complexity of parsing untrusted repository data and shell command construction. Defenders should treat Git updates as broadly applicable across development infrastructure; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Git over time
Signals from CVEs in this vendor scope (17 CVEs).
17 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-32002CRITICAL Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a | May 14, 2024 | 9.0 | 43 | NO | NO |
CVE-2017-8386HIGH git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and | Jun 1, 2017 | 8.8 | 34 | NO | NO |
CVE-2022-25648CRITICAL The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is | Apr 19, 2022 | 9.8 | 33 | NO | NO |
CVE-2015-7545CRITICAL The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restri | Apr 13, 2016 | 9.8 | 33 | NO | NO |
CVE-2008-5517HIGH The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object. | Jan 13, 2009 | 7.5 | 33 | NO | YES |
CVE-2021-23632CRITICAL All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just | Mar 17, 2022 | 9.8 | 31 | NO | NO |
CVE-2010-3906MEDIUM Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters. | Dec 17, 2010 | 4.3 | 29 | NO | YES |
CVE-2009-2108MEDIUM git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized argumen | Jun 18, 2009 | 5.0 | 28 | NO | YES |
CVE-2015-7082HIGH Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode u | Dec 11, 2015 | 10.0 | 25 | NO | NO |
CVE-2024-52005HIGH Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the clien | Jan 15, 2025 | 8.8 | 24 | NO | NO |
Signals from CVEs in this vendor scope (17 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Git.
Media articles that mention a CVE ID that affects a product developed by Git — matched by CVE ID, not by vendor name.