CVE-2020-27955

Name of the Vulnerable Software and Affected Versions Git LFS versions 2.12.0 Git versions prior to 2.29.2

Description The issue allows Remote Code Execution (RCE) on Windows systems when Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory. This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. The problem does not affect Unix systems.

Recommendations For Git LFS version 2.12.0, update to version 2.12.1 or later. For Git versions prior to 2.29.2, update to version 2.29.2 or later. As a temporary workaround, consider avoiding untrusted repositories until a patch is available.