Git-lfs vulnerabilities
We track 3 vulnerabilities in Git-lfs products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 17, 2025.
Latest Git-lfs vulnerabilities
- 8.6 High severity
git-lfs: Improper Link Resolution Before File Access
Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git wo
- 8.5 High severity
git-lfs: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then
- 7.8 High severity
git-lfs: Untrusted Search Path
On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found in `PATH`, the `..exe` program will be executed, permitting the attacker to execute arbitrary code. This does not affect