Detections
Analytics
CVE-2026-105803
high
Description
The Git LFS project reports: This release introduces security fixes for four vulnerabilities that have been assigned the identifiers CVE-2026-69260, CVE-2026-69261, CVE-2026-105802, and CVE-2026-105803. These vulnerabilities apply to all of the operating systems supported by Git LFS. CVE-2026-69260: When Git LFS sends a remote command via SSH, it does not properly format the argument it derives from the remote SSH URL. Servers which pass remote commands to a shell without sanitizing their arguments may be induced to execute malicious programs. CVE-2026-69261: After receiving an HTTP redirection, Git LFS may forward Cookie headers to a host other than the one for which they were intended. If credentials or other secrets are stored in HTTP cookies, they may be leaked to a potentially malicious host. CVE-2026-105802: When operating in a malicious repository which contains a submodule, Git LFS may execute an arbitrary program after incorrectly parsing line feed (LF) characters in the submodule's URL. CVE-2026-105803: When operating in a malicious repository, Git LFS may execute an arbitrary program as a custom transfer adapter after incorrectly filtering the options defined in an .lfsconfig file.