CVE-2020-27955

CRITICAL

Git Remote Code Execution via git-lfs (CVE-2020-27955)

Title source: metasploit
STIX 2.1

Exploitation Summary

EIP tracks 19 public exploits for CVE-2020-27955. PoCs published by ExploitBox, r00t4dm, DeeLMind, including Metasploit module exploits/windows/http/git_lfs_rce.

AI-analyzed exploit summary This repository contains a PowerShell-based reverse shell exploit for CVE-2020-27955, targeting Git LFS on Windows. The exploit leverages a vulnerability in Git LFS to achieve remote code execution (RCE) via a malicious payload.

Description

Git LFS 2.12.0 allows Remote Code Execution.

Exploits (19)

nomisec WORKING POC 30 stars
by ExploitBox · poc
https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955

This repository contains a PowerShell-based reverse shell exploit for CVE-2020-27955, targeting Git LFS on Windows. The exploit leverages a vulnerability in Git LFS to achieve remote code execution (RCE) via a malicious payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Git LFS (versions affected by CVE-2020-27955)
No auth needed
Prerequisites: Victim must execute Git LFS commands on a malicious repository · Attacker must have a listener on the specified IP and port (127.0.0.1:1337 in the PoC)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 17 stars
by r00t4dm · poc
https://github.com/r00t4dm/CVE-2020-27955

This repository contains only a README.md referencing a Medium article about CVE-2020-27955, a Git LFS vulnerability leading to remote code execution. No actual exploit code or PoC is present.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Git LFS (versions prior to 2.12.0)
No auth needed
Prerequisites: Git LFS installed on target system · Network access to vulnerable Git LFS server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 15 stars
by ExploitBox · poc
https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go

This Go-based PoC exploits CVE-2020-27955, a Git-LFS RCE vulnerability affecting multiple Git clients on Windows. It spawns a reverse shell to localhost:1337 or launches calc.exe if no listener is available.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Git, GitHub CLI, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken (Windows)
No auth needed
Prerequisites: Git-LFS enabled repository · Victim performs git clone operation
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by DeeLMind · poc
https://github.com/DeeLMind/CVE-2020-27955-LFS

This repository contains a PowerShell-based reverse shell exploit for CVE-2020-27955, a Git-LFS remote code execution vulnerability affecting multiple Git clients on Windows. The exploit leverages a malicious Git-LFS configuration to execute arbitrary commands via PowerShell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Git-LFS (affecting git, GitHub CLI, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken, etc.)
No auth needed
Prerequisites: Victim must clone a malicious repository with Git-LFS enabled · Attacker must host a malicious Git-LFS server or intercept Git-LFS traffic
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by TheTh1nk3r · poc
https://github.com/TheTh1nk3r/cve-2020-27955

This PoC demonstrates a Git LFS command injection vulnerability (CVE-2020-27955) by exploiting improper handling of Git LFS track patterns to execute arbitrary commands (e.g., `calc.exe`) during repository operations.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Git LFS (versions prior to 2.12.0)
No auth needed
Prerequisites: Git LFS installed on the target system · Ability to clone a malicious repository
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by the-chivalrousZ · poc
https://github.com/the-chivalrousZ/cve-2020-27955

The repository contains only a README.md with a placeholder description for CVE-2020-27955, lacking any functional exploit code or technical details.

Classification
Stub 10%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by Kimorea · poc
https://github.com/Kimorea/CVE-2020-27955-LFS

This repository contains a proof-of-concept exploit for CVE-2020-27955, a Git-LFS remote code execution vulnerability. The exploit leverages a PowerShell reverse shell script to achieve RCE on vulnerable Git clients.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Git-LFS (versions affected by CVE-2020-27955)
No auth needed
Prerequisites: Vulnerable Git-LFS installation · Network connectivity to attacker-controlled server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by z50913 · poc
https://github.com/z50913/CVE-2020-27955

This repository contains a working proof-of-concept exploit for CVE-2020-27955, which leverages a vulnerability in Git-LFS to achieve remote code execution via a malicious repository. The exploit uses a PowerShell reverse shell script to establish a connection back to an attacker-controlled host.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git-LFS (Git for Windows v2.29.2.windows.1)
No auth needed
Prerequisites: Victim must clone a malicious repository · Attacker must host a malicious repository · Network connectivity to attacker's host
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by userxfan · poc
https://github.com/userxfan/cve-2020-27955

The repository contains only a README.md with the CVE ID and no functional exploit code or technical details. It appears to be a placeholder or incomplete submission.

Classification
Stub 10%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by whitetea2424 · poc
https://github.com/whitetea2424/CVE-2020-27955-LFS-main

This repository contains a PowerShell-based reverse shell exploit for CVE-2020-27955, targeting Git LFS on Windows. The vulnerability allows remote code execution via malicious Git LFS configurations in affected Git clients.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Git LFS (versions affected by CVE-2020-27955)
No auth needed
Prerequisites: Victim must clone a malicious repository with crafted Git LFS configuration · Attacker must host a malicious repository
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by Marsable · poc
https://github.com/Marsable/CVE-2020-27955-LFS

This repository contains a writeup and references for CVE-2020-27955, a Git-LFS Remote Code Execution (RCE) vulnerability affecting various Git clients on Windows. It includes links to advisories, a video PoC, and mentions a Go-based exploit version.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git, GitHub CLI (gh), GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken
No auth needed
Prerequisites: Victim must clone a malicious repository with crafted Git-LFS hooks
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by nob0dy-3389 · poc
https://github.com/nob0dy-3389/CVE-2020-27955

The provided script is a trivial shell command that removes a directory, lacking any exploit logic or vulnerability demonstration for CVE-2020-27955. It does not interact with the target software or demonstrate the vulnerability.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by Arnoldqqq · poc
https://github.com/Arnoldqqq/CVE-2020-27955

This repository contains a PowerShell-based reverse shell exploit for CVE-2020-27955, a Git-LFS remote code execution vulnerability affecting multiple Git clients on Windows. The exploit leverages a malicious Git repository to execute arbitrary commands via a crafted PowerShell script.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Git, GitHub CLI (gh), GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken (Windows)
No auth needed
Prerequisites: Victim must clone a malicious Git repository with crafted Git-LFS hooks · Attacker must have a listener set up to receive the reverse shell
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by HK69s · poc
https://github.com/HK69s/CVE-2020-27955

This repository contains a PowerShell-based reverse shell exploit for CVE-2020-27955, a Git-LFS remote code execution vulnerability. The exploit leverages a malicious Git repository to execute arbitrary commands on Windows systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Git, GitHub CLI, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken
No auth needed
Prerequisites: Victim must clone a malicious Git repository with Git-LFS enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Dawid Golunski, space-r7, jheysel-r7 · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/git_lfs_rce.rb

This Metasploit module exploits CVE-2020-27955, a vulnerability in Git LFS that allows remote code execution on Windows systems when a victim clones a malicious repository. The exploit sets up a malicious Git repository with a crafted .gitattributes file and a payload disguised as a Git LFS object.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git LFS <= 2.12 and Git <= 2.29.2 on Windows
No auth needed
Prerequisites: Victim must clone the malicious repository using a vulnerable Git client on Windows · Attacker must host a malicious Git repository
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory x_refsource_misc
https://legalhackers.com
Exploit, Third Party Advisory x_refsource_misc
https://exploitbox.io
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/git-lfs/git-lfs/releases
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Nov/1
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html

Scores

CVSS v3 9.8
EPSS 0.9293
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-427
Status published
Products (2)
git-lfs/git-lfs 0 - 2.12.1Go
git_large_file_storage_project/git_large_file_storage 2.12.0
Published Nov 05, 2020
Tracked Since Feb 18, 2026