Git For Windows Project · weakness class
File and Path Handling
9 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.
- Git clone remote code execution vulnerability in git-for-windows
- Uncontrolled search for the Git directory in Git for Windows
- Untrusted search path vulnerability in Git 1.x for Windows allows local users to gain privileges via a Trojan horse git.exe file in the current working directory. NOTE: 2.x is una…
- Git looks for localized messages in the wrong place
- Git for Windows' installer can be tricked into executing an untrusted binary
- gitk can inadvertently call executables in the worktree
- Git for Windows's config file of `connect.exe` is susceptible to malicious placing
- Git CMD erroneously executes `doskey.exe` in the current directory, if it exists
- Git for Windows' installer is susceptible to DLL side loading attacks
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP