GoogleOSV:GO-2021-0073

HistoryApr 14, 2021 - 8:04 p.m.

Arbitrary command execution in github.com/git-lfs/git-lfs

2021-04-1420:04:52

Google

osv.dev

arbitrary command execution

ssh urls

lfs configuration

malicious repository

security vulnerability

AI Score

8.7

Confidence

High

EPSS

0.005

Percentile

76.3%

JSON

Arbitrary command execution can be triggered by improperly sanitized SSH URLs in LFS configuration files. This can be triggered by cloning a malicious repository.

References

blog.recurity-labs.com/2017-08-10/scm-vulns

www.securityfocus.com/bid/102926

confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html

github.com/git-lfs/git-lfs/commit/f913f5f9c7c6d1301785fdf9884a2942d59cdf19

github.com/git-lfs/git-lfs/pull/2241