Read the docs
TI-2022-13057 Aliases CVE-2022-31012

Git for Windows' installer can be tricked into executing an untrusted binary

Priority LOW 38CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when upgrading Git for Windows. A patch is included in version 2.37.1. Two workarounds are available. Create the `C:\mingw64` folder and remove read/write access from this folder, or disallow arbitrary authenticated users to create folders in `C:\`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix Fixed git (git-for-windows): 2.37.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
git-for-windowsgitbefore 2.37.12.37.1Patch availableCNA
  • git Vendorgit-for-windows Affected before 2.37.1 Fixed in 2.37.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitforwindows:git:*:*:*:*:*:windows:*:*before 2.37.1Vulnerablegit-for-windows
  • cpe:2.3:a:gitforwindows:git:*:*:*:*:*:windows:*:* Versions before 2.37.1 Vulnerable ·git-for-windows

Remediation

  • Fix · CNA git (git-for-windows) Fixed in 2.37.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31012

References

Advisory 2

  • TI-2025-40849 Git for Windows leaks NTLM hash when cloning from an attacker-controlled server CVSS 3.1HIGH 7.4
  • TI-2018-07996 In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4… CVSS 3.0HIGH 7.8
  • TI-2021-21060 In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences