Vulnerability record · CVE-2014-9390 · published 12 February 2020
CVE-2014-9390: Git clients execute commands via crafted .git/config on case-insensitive filesystems
Git Scm · Git
Git, Mercurial, libgit2, JGit, EGit and Xcode mishandle crafted .git/config paths on Windows and OS X, allowing a remote repository to place a file that the client later treats as configuration. Because the client executes what it reads from that config, cloning or pulling from an attacker-controlled server can run arbitrary commands on the victim machine.
Description
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 3.1 base score is 9.8 with network reachability, no privileges and no user interaction, and EPSS is above the 99th percentile, so unpatched clients face severe, likely exploitation.
What it is
Git, Mercurial, libgit2, JGit, EGit and Xcode mishandle crafted .git/config paths on Windows and OS X, allowing a remote repository to place a file that the client later treats as configuration. Because the client executes what it reads from that config, cloning or pulling from an attacker-controlled server can run arbitrary commands on the victim machine.
Impact
An attacker who controls a Git or Mercurial server gains arbitrary command execution on the client with the privileges of the user performing the clone, fetch or pull.
Attack surface
Reached over the network when a user clones, fetches or pulls from a malicious repository; no authentication or user interaction beyond initiating the repository operation is required, matching the AV:N/PR:N/UI:N vector. The flaw only manifests on case-insensitive filesystems such as Windows and OS X.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.75597 (99.5th percentile), indicating high predicted exploitation likelihood; references are advisories and patches rather than exploit code.
What to do
- Upgrade Git to 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 or 2.2.1 (or later) on Windows and OS X.
- Update Mercurial to 3.2.3 or later, libgit2 past 0.21.2, and JGit/EGit to builds after 08-12-2014; update Xcode to 6.2 beta 3 or later.
- Avoid cloning or pulling from untrusted repositories on case-insensitive filesystems until clients are patched.
- Audit existing working trees for unexpected .git/config or git~1/config entries and remove them.
- Restrict developer workstations from reaching untrusted Git hosts where policy allows.
Detection
- Monitor process creation on developer endpoints for shell or interpreter children spawned by git, hg or IDE Git plugins during clone, fetch or pull.
- Scan repository working trees and checkouts for .git/config, git~1/config or case-variant config paths that differ from the expected .git/config.
- Alert on outbound Git protocol traffic to newly seen or untrusted hosts from developer machines.
- Review file-integrity or EDR logs for writes to .git directories immediately followed by process execution.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-9390 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-9390), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
