CVE-2026-62960

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.

• CWE-200
• CWE-610

• https://github.com/git-for-windows/git/commit/a93524749d7806870fd2b4b00a3812da1d6e5f4a
• https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.4
• https://github.com/git-for-windows/git/security/advisories/GHSA-xrpg-8j9v-v282
• https://github.com/git-for-windows/git/security/advisories/GHSA-xrpg-8j9v-v282

Published

Aug 21, 2026

Last Modified

Aug 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62945TREK is a collaborative travel planner. Prior to 3.1.3, TREK…4.3
• CVE-2026-62946ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-62947OpenWrt is a Linux operating system targeting embedded devic…4.9
• CVE-2026-62948OpenWrt is a Linux operating system targeting embedded devic…9.6
• CVE-2026-62959Coturn is a free open source implementation of TURN and STUN…8.2
• CVE-2026-6296Heap buffer overflow in ANGLE in Google Chrome prior to 147.…9.6
• CVE-2026-62963Centrifugo is an open-source scalable real-time messaging se…8.7
• CVE-2026-6297Use after free in Proxy in Google Chrome prior to 147.0.7727…8.3
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3
• CVE-2026-62982Glances is an open-source system cross-platform monitoring t…8.8
• CVE-2026-62986OpenEXR is the reference implementation and specification fo…4.3
• CVE-2026-62988Froxlor is open source server administration software. From …9