CVE-2019-19604

Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.

• CWE-78
• CWE-862

• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/12/13/1Mailing List, Third Party Advisory
• https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.mdExploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCYSSCA5ZTEP46SB4XRPSQGFV2L3NKMZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/
• https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
• https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txtThird Party Advisory
• https://security.gentoo.org/glsa/202003-30Third Party Advisory
• https://www.debian.org/security/2019/dsa-4581Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/12/13/1Mailing List, Third Party Advisory
• https://gitlab.com/gitlab-com/gl-security/disclosures/blob/master/003_git_submodule/advisory.mdExploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCYSSCA5ZTEP46SB4XRPSQGFV2L3NKMZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/
• https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
• https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.24.1.txtThird Party Advisory
• https://security.gentoo.org/glsa/202003-30Third Party Advisory
• https://www.debian.org/security/2019/dsa-4581Third Party Advisory

Published

Dec 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19597D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary…8.8
• CVE-2019-19598D-Link DAP-1860 devices before v1.04b03 Beta allow access to…8.8
• CVE-2019-1960Multiple vulnerabilities in Cisco Enterprise NFV Infrastruct…4.4
• CVE-2019-19601OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l …7.8
• CVE-2019-19602fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in…6.1
• CVE-2019-19603SQLite 3.30.1 mishandles certain SELECT statements with a no…7.5
• CVE-2019-19605X-Plane before 11.41 allows Arbitrary Memory Write via craft…9.8
• CVE-2019-19606X-Plane before 11.41 has multiple improper path validations …9.8
• CVE-2019-19607A SQL injection vulnerability in the web conferencing compon…9.8
• CVE-2019-19608A SQL injection vulnerability in in the web conferencing com…9.8
• CVE-2019-19609The Strapi framework before 3.0.0-beta.17.8 is vulnerable to…7.2
• CVE-2019-1961A vulnerability in Cisco Enterprise NFV Infrastructure Softw…4.9