CVE-2020-27955
CRITICAL 9.8EPSS 82.3%
Git LFS 2.12.0 allows Remote Code Execution.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 82.32% chance of exploitation in the next 30 days, 100th percentile
- Published
- 2020-11-05
- Updated
- 2024-08-04
Proof-of-concept exploits (27)
- http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/Nov/1
- https://exploitbox.io
- https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html
- Arnoldqqq/CVE-2020-279550★ · 2021-05-13
- Arnoldqqq/git-lfs-poc0★ · 2021-05-13
- DeeLMind/CVE-2020-27955-LFS1★ · 2021-04-30
- ExploitBox/git-lfs-RCE-exploit-CVE-2020-2795530★ · 2021-01-12
- ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go15★ · 2020-11-04
- FrostsaberX/CVE-2020-279550★ · 2021-06-17
- HK69s/CVE-2020-279550★ · 2021-04-30
- IanSmith123/CVE-2020-279550★ · 2021-05-06
- Kimorea/CVE-2020-27955-LFS0★ · 2023-02-02
- Marsable/CVE-2020-27955-LFS0★ · 2021-05-25
- NeoDarwin/CVE-2020-279550★ · 2021-03-30
- TheTh1nk3r/cve-2020-279551★ · 2020-12-29
- ZZZWD/POC0★ · 2020-11-26
- githubfollow/ssh-reverse-git-RCE6★ · 2020-12-02
- nob0dy-3389/CVE-2020-279550★ · 2021-05-23
- r00t4dm/CVE-2020-2795517★ · 2020-11-24
- userxfan/cve0★ · 2022-04-22
- userxfan/cve-2020-279550★ · 2022-06-09
- whitetea2424/CVE-2020-27955-LFS-main0★ · 2021-08-02
- ycdxsb/PocOrExp_in_Github1219★ · 2026-10-17
- yhsung/cve-2020-27955-poc0★ · 2020-11-22
- z50913/CVE-2020-279550★ · 2022-12-16
Metasploit modules (1)
Exploit collections (1)
- Git <= 2.29.2 Git-LFS-RCE-Exploit-CVE-2020-27955.mdtzwlhack/Vulnerability