GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an…
Priority MEDIUM 44CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.
Why it matters now
EPSS 0.03677 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/git-lfs/git-lfs (Go): 2.1.1-0.20170519163204-f913f5f9c7c6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/git-lfs/git-lfs (Go) | before 2.1.1-0.20170519163204-f913f5f9c7c6 | 2.1.1-0.20170519163204-f913f5f9c7c6 | Patch available | GHSA-w4xh-w33p-4v29 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/git-lfs/git-lfs (Go) Vendor— Affected before 2.1.1-0.20170519163204-f913f5f9c7c6 Fixed in 2.1.1-0.20170519163204-f913f5f9c7c6 Patch available GHSA-w4xh-w33p-4v29
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:git_large_file_storage_project:git_large_file_storage:*:*:*:*:*:*:*:* | before 2.1.1 | Vulnerable | Git Large File Storage Project |
- cpe:2.3:a:git_large_file_storage_project:git_large_file_storage:*:*:*:*:*:*:*:* Versions before 2.1.1 Vulnerable ·Git Large File Storage Project
Remediation
- Fix · GHSA-w4xh-w33p-4v29 github.com/git-lfs/git-lfs (Go) Fixed in 2.1.1-0.20170519163204-f913f5f9c7c6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-17831
- 2026-10-03 Alias added: GHSA-w4xh-w33p-4v29
References
Advisory 3
More Git Large File Storage Project Git Large File Storage vulnerabilities
- TI-2020-17007 Git LFS 2.12.0 allows Remote Code Execution. CVSS 3.1CRITICAL 9.8
- TI-2022-08639 Git LFS can execute a binary from the current directory on Windows CVSS 3.1CRITICAL 9.8
- TI-2021-04340 Git LFS can execute a Git binary from the current directory on Windows CVSS 3.1HIGH 7.8
Sources
- CVE-2017-17831 · CVE Program
- CVE-2017-17831 · NVD
- FIRST EPSS
- GHSA-w4xh-w33p-4v29 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences