OS Command Injection in git-lfs - CVE-2026-69260
Published: October 27, 2026
Vulnerability identifier: #VU158060
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69260
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary commands on a remote SSH host under certain conditions.
The vulnerability exists due to improper neutralization of shell metacharacters in Git LFS SSH command construction when making object transfer or authentication requests using an SSH URL. A remote attacker can insert shell metacharacters into the URL's path component to inject arbitrary commands into requests sent to the remote host.
Command execution depends on the remote host passing the received commands to a shell without first sanitizing them.
Affected software
git-lfs
How to mitigate CVE-2026-69260
Install security update from vendor's website.
git-lfs - update to 3.8.1