CVE-2017-17831

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

3.68%

Published

Dec 21, 2017

Modified

May 12, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.

Weaknesses (CWE)

CWE-20

Affected Products (1)

git_large_file_storage_project · git_large_file_storage (up to 2.1.1)vulnerable

References (10)

http://blog.recurity-labs.com/2017-08-10/scm-vulns

ExploitThird Party Advisory

http://www.securityfocus.com/bid/102926

Third Party AdvisoryVDB Entry

https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html

Third Party Advisory

https://github.com/git-lfs/git-lfs/pull/2242

PatchThird Party Advisory

https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1

Release NotesThird Party Advisory