CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2014-9390
Critical (9.8). EPSS 76% chance of exploitation in the next 30 days. Fixed in org.eclipse.jgit:org.eclipse.jgit 3.5.3.
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Severity
- EPSS
- 76% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:xcode
- eclipse:egit
- eclipse:jgit
- git-scm:git
- libgit2:libgit2
- mercurial:mercurial
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6vvc-c2m3-cjf3 | Maven | org.eclipse.jgit:org.eclipse.jgit | <3.5.3 | 3.5.3 |
| GHSA-6vvc-c2m3-cjf3 | PyPI | mercurial | <3.2.3 | 3.2.3 |
| PYSEC-2020-217 | PyPI | mercurial | <3.2.3 | 3.2.3 |