Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format `key=value`. Git's documentation restricts the use of the NUL (`\0`) character and newlines to form part of the keys or values. When Git reads from standard input, it considers both LF and CRLF as newline characters for the credential protocol by virtue of calling `strbuf_getline` that calls to `strbuf_getdelim_strip_crlf`. Git also validates that a newline is not present in the value by checking for the presence of the line-feed character (LF, `\n`), and errors if this is the case. This captures both LF and CRLF-type newlines. Git Credential Manager uses the .NET standard library `StreamReader` class to read the standard input stream line-by-line and parse the `key=value` credential protocol format. The implementation of the `ReadLineAsync` method considers LF, CRLF, and CR as valid line endings. This is means that .NET considers a single CR as a valid newline character, whereas Git does not. This mismatch of newline treatment between Git and GCM means that an attacker can craft a malicious remote URL. When a user clones or otherwise interacts with a malicious repository that requires authentication, the attacker can capture credentials for another Git remote. The attack is also heightened when cloning from repositories with submodules when using the `--recursive` clone option as the user is not able to inspect the submodule remote URLs beforehand. This issue has been patched in version 2.6.1 and all users are advised to upgrade. Users unable to upgrade should only interact with trusted remote repositories, and not clone with `--recursive` to allow inspection of any submodule URLs before cloning those submodules.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS,
    and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series
    of lines of key-value pairs in the format `key=value`. Git's documentation restricts the use of the NUL
    (`\0`) character and newlines to form part of the keys or values. When Git reads from standard input, it
    considers both LF and CRLF as newline characters for the credential protocol by virtue of calling
    `strbuf_getline` that calls to `strbuf_getdelim_strip_crlf`. Git also validates that a newline is not
    present in the value by checking for the presence of the line-feed character (LF, `\n`), and errors if
    this is the case. This captures both LF and CRLF-type newlines. Git Credential Manager uses the .NET
    standard library `StreamReader` class to read the standard input stream line-by-line and parse the
    `key=value` credential protocol format. The implementation of the `ReadLineAsync` method considers LF,
    CRLF, and CR as valid line endings. This is means that .NET considers a single CR as a valid newline
    character, whereas Git does not. This mismatch of newline treatment between Git and GCM means that an
    attacker can craft a malicious remote URL. When a user clones or otherwise interacts with a malicious
    repository that requires authentication, the attacker can capture credentials for another Git remote. The
    attack is also heightened when cloning from repositories with submodules when using the `--recursive`
    clone option as the user is not able to inspect the submodule remote URLs beforehand. This issue has been
    patched in version 2.6.1 and all users are advised to upgrade. Users unable to upgrade should only
    interact with trusted remote repositories, and not clone with `--recursive` to allow inspection of any
    submodule URLs before cloning those submodules. (CVE-2024-50338)

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - An undisclosed .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

  - An undisclosed Visual Studio Remote Code Execution Vulnerability (CVE-2025-21178)

  - An undisclosed .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - An undisclosed .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

  - An undisclosed Visual Studio Remote Code Execution Vulnerability (CVE-2025-21178)

  - An undisclosed Visual Studio Elevation of Privilege Vulnerability (CVE-2025-21405)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
412472	SCA: security update for git-credential-manager (GHSA-86c2-4x57-wc8g)	Tenable Cloud Security	SCA Checks	high
412472	SCA: security update for git-credential-manager (GHSA-86c2-4x57-wc8g)	Tenable Self-Hosted Container Security	SCA Checks	high
214126	Security Updates for Microsoft Visual Studio 2022 17.6 / 17.8 / 17.10 Products (January 2025)	Nessus	Windows : Microsoft Bulletins	high
214120	Security Updates for Microsoft Visual Studio 2022 17.12 Products (January 2025)	Nessus	Windows : Microsoft Bulletins	high
214119	Security Updates for Microsoft Visual Studio 2019 16.11 / 2017 15.9 Products (January 2025)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2024-50338

high

Tenable Plugins

high

high

high

high

high