Product by Debian
Git
32 known vulnerabilities in Git (Debian), 1 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-48384 | Git allows arbitrary code execution through broken config quoting In CISA KEValso in 4 other products | 8.1 | |
| Critical | CVE-2022-23521 | gitattributes parsing integer overflow in git | 9.8 | |
| Critical | CVE-2022-41903 | Integer overflow in `git archive`, `git log --format` leading to RCE in git | 9.8 | |
| Critical | CVE-2018-17456 | Microsoft Git: Remote Code Execution | 9.8 | |
| Critical | CVE-2024-32002 | Git: Path Traversal | 9.1 | |
| High | CVE-2017-14867 | Microsoft Git: security vulnerability | 8.8 | |
| High | CVE-2021-21300 | malicious repositories can execute remote code while cloning | 8.0 | |
| Critical | CVE-2020-5260 | malicious URLs may cause Git to present stored credentials to the wrong server | 9.3 | |
| High | CVE-2023-25652 | "git apply --reject" partially-controlled arbitrary file write | 7.5 | |
| High | CVE-2018-11235 | Microsoft Git: Path Traversal | 7.8 | |
| High | CVE-2022-39260 | Git vulnerable to Remote Code Execution via Heap overflow in `git shell` | 8.5 | |
| Critical | CVE-2022-25648 | Command Injection | 8.1 | |
| High | CVE-2023-29007 | Arbitrary configuration injection via `git submodule deinit` | 7.0 | |
| High | CVE-2019-19604 | Microsoft Git: security vulnerability | 7.8 | |
| High | CVE-2021-40330 | Microsoft Git: security vulnerability | 7.5 | |
| High | CVE-2024-32004 | Git vulnerable to Remote Code Execution while cloning special-crafted local repositories | 8.2 | |
| High | CVE-2020-11008 | Malicious URLs can still cause Git to send a stored credential to the wrong server | 4.0 | |
| High | CVE-2022-47318 | Ruby-git: Code Injection | 8.0 | |
| High | CVE-2022-46648 | Ruby-git: Code Injection | 8.0 | |
| High | CVE-2024-52006 | Newline confusion in credential helpers can lead to credential exfiltration in git | 7.5 | |
| High | CVE-2024-32465 | Git's protections for cloning untrusted repositories can be bypassed | 7.4 | |
| Medium | CVE-2022-39253 | Git subject to exposure of sensitive information via local clone of symbolic links | 5.5 | |
| High | CVE-2025-46835 | Git GUI can create and overwrite files for which the user has write permission | 8.5 | |
| High | CVE-2023-23946 | Git's `git apply` overwriting paths outside the working tree | 6.2 | |
| High | CVE-2022-24765 | Uncontrolled search for the Git directory in Git for Windows | 6.0 |