In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.

An update of the git package has been released.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted
    repository that contains symbolic links as well as files with backslash characters in the file name may
    cause just-checked out code to be executed while checking out a repository using Git on Cygwin. The
    problem will be patched in the Cygwin Git v2.31.1-2 release. At time of writing, the vulnerability is
    present in the upstream Git source code; any Cygwin user who compiles Git for themselves from upstream
    sources should manually apply a patch to mitigate the vulnerability. As mitigation users should not clone
    or pull from repositories from untrusted sources. CVE-2019-1354 was an equivalent vulnerability in Git for
    Visual Studio. (CVE-2021-29468)

  - In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run
    directly. (CVE-2021-46101)

ID	Name	Product	Family	Type	Severity
333673	Photon OS 5.0: Git PHSA-2025-5.0-91-0590	Nessus	PhotonOS Local Security Checks	Local	low
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	Local	critical
404595	Alpine: git: security update to 0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
404595	Alpine: git: security update to 0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2021-46101

high

Tenable Plugins

low

critical

high

high