| id: GO-2025-3390 |
| modules: |
| - module: github.com/git-lfs/git-lfs |
| versions: |
| - introduced: 0.1.0 |
| vulnerable_at: 1.5.6 |
| - module: github.com/git-lfs/git-lfs/v3 |
| versions: |
| - introduced: 3.0.0 |
| - fixed: 3.6.1 |
| vulnerable_at: 3.6.0 |
| summary: |- |
| Git LFS permits exfiltration of credentials via crafted HTTP URLs in |
| github.com/git-lfs/git-lfs |
| cves: |
| - CVE-2024-53263 |
| ghsas: |
| - GHSA-q6r2-x2cc-vrp7 |
| credits: |
| - '@Ry0taK' |
| references: |
| - advisory: https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7 |
| - fix: https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f0022916a1c90 |
| - web: https://github.com/git-lfs/git-lfs/releases/tag/v3.6.1 |
| source: |
| id: GHSA-q6r2-x2cc-vrp7 |
| created: 2025-01-15T15:10:13.977797478Z |
| review_status: REVIEWED |
