{"id":"CVE-2020-27955","published":"2020-11-05T14:57:36Z","modified":"2024-08-04T16:25:44Z","title":"Git LFS 2.12.0 allows Remote Code Execution","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Git LFS 2.12.0 allows Remote Code Execution.","provenance":"source","from":"CVE.org"},"summary":{"text":"Git LFS 2.12.0 contains a flaw that allows Remote Code Execution. The provided information does not specify the affected component, the attack vector, or the conditions required for exploitation.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:20Z"},"cvss":null,"epss":{"score":0.82323,"percentile":0.9966,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'","url":"https://otx.alienvault.com/pulse/6668b85065eec626e4766a38","created":"2024-06-11"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://legalhackers.com","tags":["x_refsource_MISC"]},{"url":"https://exploitbox.io","tags":["x_refsource_MISC"]},{"url":"https://github.com/git-lfs/git-lfs/releases","tags":["x_refsource_MISC"]},{"url":"https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html","tags":["x_refsource_MISC"]},{"url":"http://seclists.org/fulldisclosure/2020/Nov/1","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"github.com/git-lfs/git-lfs","vulnerableRanges":["<2.12.1"],"patched":["2.12.1"],"from":["GHSA-4g4p-42wc-9f3m"],"provenance":"source"}],"advisories":[{"id":"GHSA-4g4p-42wc-9f3m","url":"https://github.com/advisories/GHSA-4g4p-42wc-9f3m","severity":"CRITICAL","ecosystem":"Go","package":"github.com/git-lfs/git-lfs","vulnerableRanges":["<2.12.1"],"patched":["2.12.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-0812","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0812","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":10,"skipped":8,"earliest":"2020-11-03","earliestUrl":"https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955","repos":[{"name":"ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955","url":"https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955","stars":30,"created":"2020-11-03"},{"name":"r00t4dm/CVE-2020-27955","url":"https://github.com/r00t4dm/CVE-2020-27955","stars":17,"created":"2020-11-24"},{"name":"ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go","url":"https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go","stars":15,"created":"2020-11-04"},{"name":"TheTh1nk3r/cve-2020-27955","url":"https://github.com/TheTh1nk3r/cve-2020-27955","stars":1,"created":"2020-12-28"},{"name":"DeeLMind/CVE-2020-27955-LFS","url":"https://github.com/DeeLMind/CVE-2020-27955-LFS","stars":1,"created":"2021-04-30"}]},"metasploit":[{"name":"Git Remote Code Execution via git-lfs (CVE-2020-27955)","module":"exploit/windows/http/git_lfs_rce","type":"exploit","disclosureDate":"2020-11-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/git_lfs_rce.rb"}],"first":{"date":"2020-11-03","source":"PoC-in-GitHub","url":"https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html","http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2020-11-03","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2020-11-04","url":"https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955","provenance":"source"},{"date":"2020-11-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-27955","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":25.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9966"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD exploit links; 10 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-git-lfs-cve-2020-27955","children":[{"from":"CVE-2020-27955","to":"CVE-2021-21237","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This is the result of an incomplete fix for CVE-2020-27955.","from":"CVE.org","in":"CVE-2021-21237"},{"kind":"osv-related","provenance":"source","id":"GHSA-cx3w-xqmc-84g5","via":"reference","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955"},{"kind":"version-step","provenance":"source","package":"Go:github.com/git-lfs/git-lfs","fromFixed":"2.12.1","toFixed":"2.13.2","daysApart":71}]}],"packageHistory":[{"cve":"CVE-2017-17831","published":"2017-12-21","fixed":"2.1.1-0.20170519163204-f913f5f9c7c6+incompatible","kev":false},{"cve":"CVE-2020-27955","published":"2020-11-05","fixed":"2.12.1","kev":false},{"cve":"CVE-2021-21237","published":"2021-01-15","fixed":"2.13.2","kev":false},{"cve":"CVE-2025-26625","published":"2025-10-17","fixed":"3.7.1","kev":false}],"package":"Go:github.com/git-lfs/git-lfs"}}