Read the docs
TI-2023-13473 Aliases CVE-2023-29012

Git CMD erroneously executes `doskey.exe` in the current directory, if it exists

Priority LOW 36CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` would be executed silently upon running Git CMD. The problem has been patched in Git for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Fix Fixed git (git-for-windows): 2.40.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
git-for-windowsgitbefore 2.40.12.40.1Patch availableCNA
  • git Vendorgit-for-windows Affected before 2.40.1 Fixed in 2.40.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:git_for_windows_project:git_for_windows:*:*:*:*:*:*:*:*before 2.40.1VulnerableGit For Windows Project
  • cpe:2.3:a:git_for_windows_project:git_for_windows:*:*:*:*:*:*:*:* Versions before 2.40.1 Vulnerable ·Git For Windows Project

Remediation

  • Fix · CNA git (git-for-windows) Fixed in 2.40.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29012

References

Advisory 1

Other 1

  • TI-2026-44986 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows CVSS 3.1HIGH 7.4
  • TI-2025-40849 Git for Windows leaks NTLM hash when cloning from an attacker-controlled server CVSS 3.1HIGH 7.4
  • TI-2018-07996 In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4… CVSS 3.0HIGH 7.8
  • TI-2026-85080 Out-of-bounds write in Git for Windows credential helper CVSS 3.1MEDIUM 4.4
  • TI-2022-20294 Git clone remote code execution vulnerability in git-for-windows CVSS 3.1HIGH 8.6
  • TI-2023-09447 gitk can inadvertently call executables in the worktree CVSS 3.1HIGH 8.6
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences