git-for-windows git
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-62960 | < 2.55.0.windows.4 | Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows | HIGH 7.4 | 0.5 % | ||
| CVE-2026-32631 | < 2.53.0.windows.3 | Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers | HIGH 7.4 | 0.3 % | ||
| CVE-2025-66413 | < 2.53.0(2) | Git for Windows leaks NTLM hash when cloning from an attacker-controlled server | HIGH 7.4 | 0.3 % | ||
| CVE-2023-29012 | < 2.40.1 | Git CMD erroneously executes `doskey.exe` in the current directory, if it exists | HIGH 7.8 | 0.4 % | ||
| CVE-2023-29011 | < 2.40.1 | Git for Windows's config file of `connect.exe` is susceptible to malicious placing | HIGH 7.8 | 0.4 % | ||
| CVE-2023-25815 | < 2.40.1 | Git looks for localized messages in the wrong place | LOW 3.3 | 0.8 % | ||
| CVE-2023-22743 | < 2.39.2 | Git for Windows' installer is susceptible to DLL side loading attacks | HIGH 7.3 | 0.4 % | ||
| CVE-2023-23618 | < 2.39.2 | gitk can inadvertently call executables in the worktree | HIGH 8.6 | 0.4 % | ||
| CVE-2022-41953 | < 2.39.1 | Git clone remote code execution vulnerability in git-for-windows | HIGH 8.6 | 6.8 % | ||
| CVE-2022-31012 | < 2.37.1 | Git for Windows' installer can be tricked into executing an untrusted binary | HIGH 8.2 | 0.4 % | ||
| CVE-2022-24765 | < 2.35.2 | Uncontrolled search for the Git directory in Git for Windows | HIGH 7.8 | 1.0 % |