CVE-2022-39253Git subject to exposure of sensitive information via local clone of symbolic links
- 5.5MediumCVSS base score
- 1.5%Exploitation in 30 daysEPSS · top 26% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.
Timeline
ID reserved
By GitHub_M
- 47 days later
· 47 days later
Published
- 22 months later
· 22 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.5% · top 26% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
References
References12
- https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85 (opens in a new tab)x_transferred
- FEDORA-2022-12790ca71a (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-8b58806840 (opens in a new tab)vendor-advisoryx_transferred
- https://support.apple.com/kb/HT213496 (opens in a new tab)x_transferred
- FEDORA-2022-53aadd995f (opens in a new tab)vendor-advisoryx_transferred
- 20221107 APPLE-SA-2022-11-01-1 Xcode 14.1 (opens in a new tab)mailing-listx_transferred
- FEDORA-2022-2c33bba286 (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-fb088df94c (opens in a new tab)vendor-advisoryx_transferred
- [debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update (opens in a new tab)mailing-listx_transferred
- [oss-security] 20230214 [Announce] Git 2.39.2 and friends (opens in a new tab)mailing-listx_transferred
- GLSA-202312-15 (opens in a new tab)vendor-advisoryx_transferred
- [oss-security] 20240514 git: 5 vulnerabilities fixed (opens in a new tab)mailing-listx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2022-41767 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-39253)Record last updated .