Improper Neutralization of Line Delimiters in git-lfs - CVE-2026-105802
Published: October 27, 2026
Vulnerability identifier: #VU158062
CSH Severity: High
CVSS v4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105802
CWE-ID: CWE-144
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary commands on the victim's system.
The vulnerability exists due to improper neutralization of line delimiters in the Git LFS configuration parser when reading submodule configuration options while fetching or adding objects. A remote attacker can embed line-ending control characters, such as line feed (LF), in configuration values in a malicious repository to mimic additional options and execute arbitrary commands.
Affected software
git-lfs
How to mitigate CVE-2026-105802
Install security update from vendor's website.
git-lfs - update to 3.8.1