CVE-2021-21237

Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. Other than avoiding untrusted repositories or using a different operating system, there is no workaround. This is fixed in v2.13.2.

• CWE-426

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955Third Party Advisory
• https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72aPatch, Third Party Advisory
• https://github.com/git-lfs/git-lfs/releases/tag/v2.13.2Third Party Advisory
• https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5Third Party Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955Third Party Advisory
• https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72aPatch, Third Party Advisory
• https://github.com/git-lfs/git-lfs/releases/tag/v2.13.2Third Party Advisory
• https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5Third Party Advisory

Published

Jan 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21231Insufficient data validation in V8 in Google Chrome prior to…8.8
• CVE-2021-21232Use after free in Dev Tools in Google Chrome prior to 90.0.4…8.8
• CVE-2021-21233Heap buffer overflow in ANGLE in Google Chrome on Windows pr…8.8
• CVE-2021-21234spring-boot-actuator-logview in a library that adds a simple…7.7
• CVE-2021-21235kamadak-exif is an exif parsing library written in pure Rust…6.5
• CVE-2021-21236CairoSVG is a Python (pypi) package. CairoSVG is an SVG conv…5.5
• CVE-2021-21238PySAML2 is a pure python implementation of SAML Version 2 St…6.5
• CVE-2021-21239PySAML2 is a pure python implementation of SAML Version 2 St…6.5
• CVE-2021-2124Vulnerability in the Oracle VM VirtualBox product of Oracle …6
• CVE-2021-21240httplib2 is a comprehensive HTTP client library for Python. …7.5
• CVE-2021-21241The Python "Flask-Security-Too" package is used for adding s…7.4
• CVE-2021-21242OneDev is an all-in-one devops platform. In OneDev before ve…9.8