Git Project's vulnerability profile centers on the widely embedded distributed version-control system, where disclosed issues cluster around access-control enforcement, input validation, and command-injection risks in repository operations. The durable signal reflects the security-sensitive scope of a tool that processes untrusted repository data and executes system commands on behalf of users; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Git Project over time
Signals from CVEs in this vendor scope (17 CVEs).
17 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-32002CRITICAL Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a | May 14, 2024 | 9.0 | 43 | NO | NO |
CVE-2017-8386HIGH git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and | Jun 1, 2017 | 8.8 | 34 | NO | NO |
CVE-2022-25648CRITICAL The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is | Apr 19, 2022 | 9.8 | 33 | NO | NO |
CVE-2015-7545CRITICAL The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restri | Apr 13, 2016 | 9.8 | 33 | NO | NO |
CVE-2008-5517HIGH The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object. | Jan 13, 2009 | 7.5 | 33 | NO | YES |
CVE-2021-23632CRITICAL All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just | Mar 17, 2022 | 9.8 | 31 | NO | NO |
CVE-2010-3906MEDIUM Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters. | Dec 17, 2010 | 4.3 | 29 | NO | YES |
CVE-2009-2108MEDIUM git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized argumen | Jun 18, 2009 | 5.0 | 28 | NO | YES |
CVE-2015-7082HIGH Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode u | Dec 11, 2015 | 10.0 | 25 | NO | NO |
CVE-2024-52005HIGH Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the clien | Jan 15, 2025 | 8.8 | 24 | NO | NO |
Signals from CVEs in this vendor scope (17 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Git Project.
Media articles that mention a CVE ID that affects a product developed by Git Project — matched by CVE ID, not by vendor name.