SB2026102748 - Multiple vulnerabilities in git-lfs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102748

SB2026102748 - Multiple vulnerabilities in git-lfs

Published: October 27, 2026

Security Bulletin ID SB2026102748
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2026-69260)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary commands on a remote SSH host under certain conditions.

The vulnerability exists due to improper neutralization of shell metacharacters in Git LFS SSH command construction when making object transfer or authentication requests using an SSH URL. A remote attacker can insert shell metacharacters into the URL's path component to inject arbitrary commands into requests sent to the remote host.

Command execution depends on the remote host passing the received commands to a shell without first sanitizing them.


2) Regular Expression without Anchors (CVE-ID: CVE-2026-105803)

CWE-ID: CWE-777 - Regular Expression without Anchors

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary commands on a victim's system.

The vulnerability exists due to a regular expression without anchors in Git LFS configuration filtering when processing repository-supplied .lfsconfig files during object fetching. A remote attacker can supply a malicious repository containing configuration keys with additional components that bypass filtering and mimic custom object transfer options to execute arbitrary commands on the victim's system.


3) Improper Neutralization of Line Delimiters (CVE-ID: CVE-2026-105802)

CWE-ID: CWE-144 - Improper Neutralization of Line Delimiters

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary commands on the victim's system.

The vulnerability exists due to improper neutralization of line delimiters in the Git LFS configuration parser when reading submodule configuration options while fetching or adding objects. A remote attacker can embed line-ending control characters, such as line feed (LF), in configuration values in a malicious repository to mimic additional options and execute arbitrary commands.


4) Insufficiently protected credentials (CVE-ID: CVE-2026-69261)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive cookies and potentially gain unauthorized access using exposed credentials.

The vulnerability exists due to insufficient protection of credentials in Git LFS HTTP redirect handling when forwarding headers to a different host. A remote attacker can exploit a redirect to a host under their control to receive cookies intended for another host and potentially use exposed credentials to gain unauthorized access.

Authorization headers are not forwarded to inappropriate hosts; Cookie headers may be forwarded incorrectly.


Remediation

Install update from vendor's website.

References