CVE-2020-27955

9.8 criticalEPSS 82%

Critical (9.8) in git large file storage project git large file storage. EPSS 82% chance of exploitation in the next 30 days. Fixed in github.com/git-lfs/git-lfs 2.12.1.

Git LFS 2.12.0 allows Remote Code Execution.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 82% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-427
Published: 2020-11-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

git_large_file_storage_project:git_large_file_storage

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4g4p-42wc-9f3m	Go	github.com/git-lfs/git-lfs	<2.12.1	2.12.1

References

http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html
http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2020/Nov/1
https://exploitbox.io
https://github.com/git-lfs/git-lfs/releases

Check your stack JSON