Patchfirst
Patchfirst
CVE-2020-27955 Public exploit EPSS 82.3%

Git LFS 2.12.0 allows Remote Code Execution.

Summary

Git LFS 2.12.0 contains a flaw that allows Remote Code Execution. The provided information does not specify the affected component, the attack vector, or the conditions required for exploitation.

Heading is the official description · CVE.org
Breakdown
25.6 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) was available 2 days before disclosure.

  1. Public exploit codePoC-in-GitHub2 days before
  2. Disclosedday 0

See the family tree

A fix was bypassed or incomplete once over 4 years. The latest fix listed for github.com/git-lfs/git-lfs is 3.7.1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2020-27955Git LFS 2.12.0 allows Remote Code Execution5 Nov 2020
  2. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textThis is the result of an incomplete fix for CVE-2020-27955.
    • Linked in OSV/GitHub advisoryGHSA-cx3w-xqmc-84g5
    • Fixed one release later2.12.1 → 2.13.2 (github.com/git-lfs/git-lfs)
    CVE-2021-21237Git LFS can execute a Git binary from the current directory on…15 Jan 2021
  3. relatedMedium

    Why these are linked:

    CVE-2024-53263Git LFS permits exfiltration of credentials via crafted HTTP…14 Jan 2025

Fixes in github.com/git-lfs/git-lfsGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.1-0.20170519163204-f913f5f9c7c6+incompatibleCVE-2017-1783121 Dec 2017
  2. 2.12.1CVE-2020-279555 Nov 2020
  3. 2.13.2CVE-2021-2123715 Jan 2021
  4. 3.7.1CVE-2025-2662517 Oct 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/git-lfs/git-lfs.

Gogithub.com/git-lfs/git-lfsGHSA-4g4p-42wc-9f3m

Upgrade to 2.12.1 or later

Gogo get github.com/git-lfs/git-lfs@v2.12.1

The first fix for CVE-2020-27955. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
All versions before 2.12.12.12.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

7 links, grouped by NVD tag

x_refsource_MISC 6

legalhackers.comexploitbox.iogithub.com/git-lfs/git-lfs/releaseslegalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.htmlpacketstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.htmlpacketstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html

mailing-list 1

seclists.org/fulldisclosure/2020/Nov/1
↑ ↓ chooseEnter openEsc close