Critical 9.8Published Feb 11, 2020

CVE-2014-9390Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3;…

Updated under an hour ago (Nov 2, 2026, 12:20 AM ET)

Does this affect you?

It affects git-scm git and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for git-scm git Exploited in the last 30 days

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

CVSS: 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-20
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

git-scm git git-scm:git	before 1.8.5.6; from 1.9.0 before 1.9.5; from 2.0.0 before 2.0.5; from 2.1.0 before 2.1.4; from 2.2.0 before 2.2.1	NVD
mercurial mercurial mercurial:mercurial	before 3.2.3	NVD
apple xcode apple:xcode	through 6.1.1; 6.2; 6.2	NVD
eclipse egit eclipse:egit	before 08-12-2014	NVD
eclipse jgit eclipse:jgit	before 3.4.2; from 3.5.0 before 3.5.3	NVD
libgit2 libgit2 libgit2:libgit2	before 0.21.3	NVD

References

References

http://article.gmane.org/gmane.linux.kernel/1853266	broken-link
http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html	third-party-advisory
http://mercurial.selenic.com/wiki/WhatsNew	release-notes, third-party-advisory
http://securitytracker.com/id?1031404	third-party-advisory, vdb-entry
http://support.apple.com/kb/HT204147	vendor-advisory
https://github.com/blog/1938-git-client-vulnerability-announced	vendor-advisory
https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915	third-party-advisory
https://libgit2.org/security/	product
https://news.ycombinator.com/item?id=8769667	issue-tracking, patch, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.