https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:27:06.374587+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-01368 cnvd-2018-01368 2026-10-03T20:27:06.471486+00:00 cnvd-2018-01368 https://cve.radiocsirt.org/vuln/euvd-2026-79816 EUVD-2026-79816 2026-10-03T20:27:06.471527+00:00 EUVD-2026-79816 https://cve.radiocsirt.org/vuln/fkie_cve-2017-17831 fkie_cve-2017-17831 2026-10-03T20:27:06.471542+00:00

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.

 https://cve.radiocsirt.org/vuln/ghsa-w4xh-w33p-4v29 GHSA-w4xh-w33p-4v29 — GitHub Git LFS Arbitrary command execution vulnerability 2026-10-03T20:27:06.471574+00:00

Affected: Go: github.com/git-lfs/git-lfs

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a `url =` line in a `.lfsconfig` file within a repository. ### Specific Go Packages Affected github.com/git-lfs/git-lfs/lfsapi

 https://cve.radiocsirt.org/vuln/gsd-2017-17831 gsd-2017-17831 2026-10-03T20:27:06.471600+00:00 gsd-2017-17831 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-17831 Withdrawn: UBUNTU-CVE-2017-17831 2026-10-03T20:27:06.471612+00:00

Withdrawn by the publisher.

Affected: Ubuntu:18.04:LTS: git-lfs

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.