Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers (git-for-windows git)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.32 % · percentile 25 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Awaiting Analysis
Description
Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction. By brute-forcing the NTLMv2 hash (which is expensive, but possible), credentials can be extracted. This issue has been fixed in version 2.53.0.windows.3.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
- https://github.com/git-for-windows/git/security/advisories/GHSA-9j5h-h4m7-85hx
- https://github.com/git-for-windows/git/releases/tag/v2.53.0.windows.3
- https://learn.microsoft.com/en-au/windows/whats-new/deprecated-features#:~:text=NTLM
- https://support.microsoft.com/en-us/topic/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025-c0554217-cdbc-420f-b47c-e02b2db49b2e
- https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/3926848
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N | GitHub_M |
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-22991
- GCVE · GCVE-0-2026-32631
CERT-FR advisories
- CERTFR-2026-AVI-0445 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| git-for-windows · git | affected < 2.53.0.windows.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |