CVE-2021-21300

🗓️ 09 Mar 2021 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1044 Views🌐 WEB

Git open-source distributed revision control system. Specially crafted repository with symbolic links/files using clean/smudge filter may execute just-checked out script during cloning on case-insensitive file systems. Patched in versions from March 9th, 2021

Reporter	Title	Published	Views	Family All 124
zdt	Git LFS Clone Command Execution Exploit	31 Aug 202100:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in MS Visual Studio (CVE-2021-21300).	12 Jan 202321:59	–	ibm
ATTACKERKB	CVE-2021-21300	9 Mar 202120:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : git (ALAS-2021-1621)	27 Mar 202100:00	–	nessus
Tenable Nessus	Amazon Linux AMI : git (ALAS-2021-1490)	25 Mar 202100:00	–	nessus
Tenable Nessus	Debian dla-3145 : git - security update	13 Oct 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : git (EulerOS-SA-2021-1870)	18 May 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : git (EulerOS-SA-2021-1897)	18 May 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : git (EulerOS-SA-2021-1923)	3 Jun 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : git (EulerOS-SA-2021-1944)	3 Jun 202100:00	–	nessus

NVD

Vulners

Node

git-scm gitRange≤2.14.2

git-scm gitRange2.17.0–2.17.6

git-scm gitRange2.18.0–2.18.5

git-scm gitRange2.19.0–2.19.6

git-scm gitRange2.20.0–2.20.5

git-scm gitRange2.21.0–2.21.4

git-scm gitRange2.22.0–2.22.5

git-scm gitRange2.23.0–2.23.4

git-scm gitRange2.24.0–2.24.4

git-scm gitRange2.25.0–2.25.5

git-scm gitRange2.26.0–2.26.3

git-scm gitRange2.29.0–2.29.3

git-scm gitRange2.30.0–2.30.2

git-scm gitMatch2.27.0

git-scm gitMatch2.28.0

Node

fedoraproject fedoraMatch32

fedoraproject fedoraMatch33

fedoraproject fedoraMatch34

Node

AND

apple xcodeRange<12.5

apple macosRange11.0≥

Node

debian debian_linuxMatch10.0

[
  {
    "vendor": "git",
    "product": "git",
    "versions": [
      {
        "version": ">= 2.14.2, < 2.17.62.17.6",
        "status": "affected"
      },
      {
        "version": ">= 2.18.0, < 2.18.5",
        "status": "affected"
      },
      {
        "version": ">= 2.19.0, < 2.19.6",
        "status": "affected"
      },
      {
        "version": ">= 2.20.0, < 2.20.5",
        "status": "affected"
      },
      {
        "version": ">= 2.21.0, < 2.21.4",
        "status": "affected"
      },
      {
        "version": ">= 2.22.0, < 2.22.5",
        "status": "affected"
      },
      {
        "version": ">= 2.23.0, < 2.23.4",
        "status": "affected"
      },
      {
        "version": ">= 2.24.0, < 2.24.4",
        "status": "affected"
      },
      {
        "version": ">= 2.25.0, < 2.25.5",
        "status": "affected"
      },
      {
        "version": ">= 2.26.0, < 2.26.3",
        "status": "affected"
      },
      {
        "version": ">= 2.27.0, < 2.27.1",
        "status": "affected"
      },
      {
        "version": ">= 2.28.0, < 2.28.1",
        "status": "affected"
      },
      {
        "version": ">= 2.29.0, < 2.29.3",
        "status": "affected"
      },
      {
        "version": ">= 2.30.0, < 2.30.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
security	www.security.gentoo.org/glsa/202104-01
packetstormsecurity	www.packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/
git-scm	www.git-scm.com/docs/gitattributes
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/
lore	www.lore.kernel.org/git/xmqqim6019yd.fsf%40gitster.c.googlers.com/
openwall	www.openwall.com/lists/oss-security/2021/03/09/3
git-scm	www.git-scm.com/docs/git-config
github	www.github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/

Parameter	Position	Path	Description	CWE
git-upload-pack	path	/<repo>.git/git-upload-pack	Git LFS clone via git-upload-pack can lead to remote code execution when using delay-capable clean/smudge filters on case-insensitive FS.	CWE-59

17 Jun 2026 03:35Current

7.7High risk

Vulners AI Score7.7

CVSS 25.1

CVSS 3.17.5 - 8

EPSS0.88644

CWE-59