Git Releases Security Fix for Clone-Time Code Execution

The Git project has published new versions addressing CVE-2021-21300, a vulnerability in the delayed checkout mechanism that Git LFS relies on during git clone operations. The flaw affects Git versions 2.15 and newer.

Under specific conditions, a maliciously crafted repository can trigger code execution during clone on case-insensitive filesystems that support symbolic links. The attack works by abusing certain clean/smudge filters, including those configured by Git LFS.

The recommended course of action is upgrading to Git 2.30.2. For situations where an immediate upgrade isn't feasible, several risk-reduction measures are available:

  • Disable symbolic link support globally: git config --global core.symlinks false
  • Disable long-running process filters. To check if any are active, run git config --show-scope --get-regexp 'filter\..*\.process'1
  • Avoid cloning repositories from untrusted sources

GitHub's own infrastructure is unaffected. The platform keeps no checked-out copies of repositories on its servers, with the exception of GitHub Pages, which runs no clean/smudge filters. The vulnerability was discovered and patched by Matheus Tavares and Johannes Schindelin. Updated Git packages are available from the project download page.

1. In Windows Command Prompt, use double quotes instead of single quotes in that command.