# CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution.

- Page: https://www.vulneraibility.com/cve/CVE-2020-27955
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 82.32% (percentile 99.7)
- Public exploit code: 1 Metasploit module · 18 GitHub proofs of concept (first 2020-11-03)
- Published: 2020-11-05

## Affected

- git_large_file_storage_project:git_large_file_storage

## References

- [other] https://legalhackers.com
- [other] https://exploitbox.io
- [other] https://github.com/git-lfs/git-lfs/releases
- [other] https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html
- [other] http://seclists.org/fulldisclosure/2020/Nov/1
- [other] http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.