CVE-2022-39260highCWE-122CWE-787

CVE-2022-39260: high-severity vulnerability in git

Git vulnerable to Remote Code Execution via Heap overflow in `git shell`

Published · Updated

Follow this CVE+ Monitor git+ Monitor git

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 4.0%
In short

Git's restricted shell (`git shell`) contains a heap overflow vulnerability that allows attackers to execute arbitrary code on a server. An attacker with SSH access to `git shell` can craft a malicious command that overflows memory and takes control of the system.

Technical detail

The vulnerability exists in the argument-splitting function of `git shell`, which uses a 32-bit integer to track array size, enabling integer overflow. An authenticated attacker can send a specially crafted command via SSH that overflows the heap, corrupts memory, and passes a malicious argument array to `execv()`, achieving remote code execution. Exploitation requires prior SSH access to `git shell` as a login shell.

Summary generated and translated by AI from the official description.
Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
git · git
Related CVEs — git

In the same product, most dangerous first.

CVE-2025-48384HIGHGit allows arbitrary code execution through broken config quotingEPSS 4.5%KEVCVE-2021-21300HIGHmalicious repositories can execute remote code while cloningEPSS 88.5%CVE-2022-23521CRITICALgitattributes parsing integer overflow in gitEPSS 56.3%CVE-2023-25652HIGH"git apply --reject" partially-controlled arbitrary file writeEPSS 51.9%CVE-2022-41903CRITICALInteger overflow in `git archive`, `git log --format` leading to RCE in gitEPSS 44.3%CVE-2024-32002CRITICALGit's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code ExecutionEPSS 29.2%