CVE-2023-29012: Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an…

PriorityP336high7.8CVSS 3.1

AVLACLPRNUIRSUCHIHAH

EPSS

0.38%

29.8th percentile

Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` would be executed silently upon running Git CMD. The problem has been patched in Git for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted directory.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
git-for-windows	git	< 2.40.1	2.40.1
git_for_windows_project	git_for_windows	< 2.40.1	2.40.1
msrc	microsoft_visual_studio_2017_version_15.9	—	—
msrc	microsoft_visual_studio_2019_version_16.11	—	—
msrc	microsoft_visual_studio_2022_version_17.0	—	—
msrc	microsoft_visual_studio_2022_version_17.2	—	—
msrc	microsoft_visual_studio_2022_version_17.4	—	—
msrc	microsoft_visual_studio_2022_version_17.6	—	—

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vendor_msrc7.2HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.