https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 06 Nov 2026 16:29:58 +0000 https://db.gcve.eu/vuln/ghsa-cx3w-xqmc-84g5 <p><strong>Affected:</strong> Go: github.com/git-lfs/git-lfs</p> <p>### Impact On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.</p> <p>This is the result of an incomplete fix for CVE-2020-27955.</p> <p>This issue occurs because on Windows, [Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator](https://github.com/golang/go/issues/38736).</p> <p>### Patches This version should be patched in v2.13.2, which will be released in coordination with this security advisory.</p> <p>### Workarounds Other than avoiding untrusted repositories or using a different operating system, there is no workaround.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>- Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions). - If you cannot open a discussion, please email the core team using their usernames at `github.com`.</p> <p><strong>Affected:</strong> Go: github.com/git-lfs/git-lfs</p> <p>### Impact On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.</p> <p>This is the result of an incomplete fix for CVE-2020-27955.</p> <p>This issue occurs because on Windows, [Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator](https://github.com/golang/go/issues/38736).</p> <p>### Patches This version should be patched in v2.13.2, which will be released in coordination with this security advisory.</p> <p>### Workarounds Other than avoiding untrusted repositories or using a different operating system, there is no workaround.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>- Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions). - If you cannot open a discussion, please email the core team using their usernames at `github.com`.</p> https://db.gcve.eu/vuln/ghsa-cx3w-xqmc-84g5