GO-2021-0098

    Dashboard / Vulnerabilities / GO-2021-0098

    GO-2021-0098

    Published: 14 Apr 2021Last Modified: 20 May 2024

    Summary: Arbitrary code execution on Windows in github.com/git-lfs/git-lfs

    Details: Due to the standard library behavior of exec.LookPath on Windows a number of methods may result in arbitrary code execution when cloning or operating on untrusted Git repositories.

    References: https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72a

    Affected packages

    Package

    Name: github.com/git-lfs/git-lfs

    Purl: pkg:golang/github.com/git-lfs/git-lfs

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.5.1-0.20210113180018-fc664697ed2c

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2021-0098 | CVE-DB