CVE-2021-29468

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on Cygwin. The problem will be patched in the Cygwin Git v2.31.1-2 release. At time of writing, the vulnerability is present in the upstream Git source code; any Cygwin user who compiles Git for themselves from upstream sources should manually apply a patch to mitigate the vulnerability. As mitigation users should not clone or pull from repositories from untrusted sources. CVE-2019-1354 was an equivalent vulnerability in Git for Visual Studio.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
me-and	Cygwin-Git	< 2.31.1-2

References

https://cygwin.com/pipermail/cygwin-announce/2021-April/010018.htmlMailing List, Patch, Vendor Advisory
https://github.com/me-and/Cygwin-Git/blob/main/check-backslash-safety.patchPatch, Third Party Advisory
https://github.com/me-and/Cygwin-Git/security/advisories/GHSA-rmp3-wq55-f557Patch, Third Party Advisory
https://lore.kernel.org/git/CA+kUOa=juEdBMVr_gyTKjz7PkPt2DZHkXQyzcQmAWCsEHC_ssw%40mail.gmail.com/T/#u
https://cygwin.com/pipermail/cygwin-announce/2021-April/010018.htmlMailing List, Patch, Vendor Advisory
https://github.com/me-and/Cygwin-Git/blob/main/check-backslash-safety.patchPatch, Third Party Advisory
https://github.com/me-and/Cygwin-Git/security/advisories/GHSA-rmp3-wq55-f557Patch, Third Party Advisory
https://lore.kernel.org/git/CA+kUOa=juEdBMVr_gyTKjz7PkPt2DZHkXQyzcQmAWCsEHC_ssw%40mail.gmail.com/T/#u

Timeline

Published: Apr 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294697.5Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor me CVE-2021-294706.5Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds CVE-2021-294715.3Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant CVE-2021-294728.8Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not CVE-2021-294732.5Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds CVE-2021-294745.8HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker can read arbitrary `.md` files from the ser CVE-2021-2947510.0HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the CVE-2021-294769.8Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of CVE-2021-294778.8Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow b CVE-2021-294788.8Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow b CVE-2021-294796.1Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to per CVE-2021-294803.1Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup