git-lfs-RCE-exploit-CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

ofrak

OFRAK OFRAK Open Firmware Reverse Analysis Konsole is a binary analysis and modification platform. OFRAK combines the ability to: Identify and Unpack many binary formats Analyze unpacked binaries with field-tested reverse engineering tools Modify and Repack binaries with powerful patching...

CVE-2020-27955

CVE-2020-27955 Thanks https://medium.com/bugbountywriteup/git-lfs-exploit-for-remote-code-execution-cve-2020-27955-e8f4786163c3...

cve-2020-27955

cve-2020-27955 cve-2020-27955 Reproduction 1. Create a GitHub repository 2. git clone https://github.com/attacker/poc.git . 3. echo calc.exe git.cmd 4. git lfs track “.dat” 5. echo “Junk” large.dat 6. git add -A 7. git commit -m “POC” 8. git push -u origin master -f...

git-lfs-RCE-exploit-CVE-2020-27955-Go

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 Go version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub CLI gh, GitHub...

CVE-2020-27955-LFS

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955

CVE-2020-27955 Vulnerability Reproduction 1. Download the vulnerable version of Git-LFS on the Windows machine Download link: https://github.com/git-for-windows/git/releases/tag/v2.29.2.windows.1 2. Install on the Windows machine, add the following information to the hosts file. 10.1.1.5 is the...

CVE-2020-27955-LFS-main

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955-LFS

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955-LFS

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

The vulnerability in the `services/lfs/server.go` and `routers/private/serv.go` files of the Git repository management system Gitea allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the services/lfs/server.go and routers/private/serv.go files of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected...

CVE-2026-22004-Git-LFS-Pointer-Poisoning-Supply-Chain-

CVE-2026-22004 – Git LFS Pointer Poisoning Supply Chain Program Code Bash + Python createmaliciousrepo.sh - Sets up a repo with poisoned LFS pointer git init git lfs track ".bin" echo "version https://git-lfs.github.com/spec/v1 oid...

Rocky Linux 10.1 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2026_7005)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20267005 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource Multiple Vulnerabilities (crlsa-2026_14200)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202614200 advisory. golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32282 crypto/tls: golang: Go crypto/tls: Denial of Service via...

Rocky Linux 9.2 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource Multiple Vulnerabilities (ciqsa-2026_1007)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261007 advisory. This advisory aggregates security fixes for the git-lfs SRPM in CIQ LTS 9.2. It addresses 4 CVEs: CVE-2023-45288, CVE-2023-45290, CVE-2023-45289,...

AlmaLinux 9.2 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762539123)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762539123 advisory. - Processing an incomplete post-handshake message for a QUIC connection can cause a panic. CVE-2023-39321 - QUIC connections do not...

Rocky Linux 10.2 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource Multiple Vulnerabilities (crlsa-2026_19133)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619133 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the roo...

Rocky Linux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1776336504)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776336504 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...