CVE-2023-29007High· 7.0▾ MidnightPoC available

Arbitrary configuration injection via `git submodule deinit`

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characte…

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score52/ 100 · Moderate

impact 38.5 · likelihood 1.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Apr 25, 2023

Updated

Nov 2, 2026

CVSS

7.0

Vendor

git

Product

git

CWE

CWE-74

Depth score

52 · Moderate

EPSS

5.6% · p93

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-11-05

GitHub PoCs

2 public repositories

CISA SSVC

decided 2024-01-22

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 1291 days

Apr 25, 2023Published
Disclosed via CVEORG
Nov 2, 2026Record revised
Last analysed / modified upstream
Nov 5, 2026EPSS first tracked
5.6%
Nov 5, 2026Public exploit observed
2 GitHub repos (last check)

git CWE-74 #cve.org #exploit-available

Affected

git < 2.30.9
git >= 2.31.0, < 2.31.8
git >= 2.32.0, < 2.32.7
git >= 2.33.0, < 2.33.8
git >= 2.34.0, < 2.34.8
git >= 2.35.0, < 2.35.8
git >= 2.36.0, < 2.36.6
git >= 2.37.0, < 2.37.7
git >= 2.38.0, < 2.38.5
git >= 2.39.0, < 2.39.3
git >= 2.40.0, < 2.40.1

Full technical detail▾

Overview

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted .gitmodules file with submodule URLs that are longer than 1024 characters can used to exploit a bug in config.c::git_config_copy_or_rename_section_in_file(). This bug can be used to inject arbitrary configuration into a user's $GIT_DIR/config when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as core.pager, core.editor, core.sshCommand, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running git submodule deinit on untrusted repositories or without prior inspection of any submodule sections in $GIT_DIR/config.

Affected

git < 2.30.9
git >= 2.31.0, < 2.31.8
git >= 2.32.0, < 2.32.7
git >= 2.33.0, < 2.33.8
git >= 2.34.0, < 2.34.8
git >= 2.35.0, < 2.35.8
git >= 2.36.0, < 2.36.6
git >= 2.37.0, < 2.37.7
git >= 2.38.0, < 2.38.5
git >= 2.39.0, < 2.39.3
git >= 2.40.0, < 2.40.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available

← Back to feed

CVE-2023-29007High· 7.0▾ MidnightPoC available

Arbitrary configuration injection via `git submodule deinit`

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score52/ 100 · Moderate

impact 38.5 · likelihood 1.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Apr 25, 2023

Updated

Nov 2, 2026

CVSS

7.0

Vendor

git

Product

git

CWE

CWE-74

Depth score

52 · Moderate

EPSS

5.6% · p93

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-11-05

GitHub PoCs

2 public repositories

CISA SSVC

decided 2024-01-22

Exploitation: none
Automatable: no
Technical impact: total

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 1291 days

Apr 25, 2023Published
Disclosed via CVEORG
Nov 2, 2026Record revised
Last analysed / modified upstream
Nov 5, 2026EPSS first tracked
5.6%
Nov 5, 2026Public exploit observed
2 GitHub repos (last check)

git CWE-74 #cve.org #exploit-available

Affected

git < 2.30.9
git >= 2.31.0, < 2.31.8
git >= 2.32.0, < 2.32.7
git >= 2.33.0, < 2.33.8
git >= 2.34.0, < 2.34.8
git >= 2.35.0, < 2.35.8
git >= 2.36.0, < 2.36.6
git >= 2.37.0, < 2.37.7
git >= 2.38.0, < 2.38.5
git >= 2.39.0, < 2.39.3
git >= 2.40.0, < 2.40.1

Full technical detail▾

Overview

Affected

git < 2.30.9
git >= 2.31.0, < 2.31.8
git >= 2.32.0, < 2.32.7
git >= 2.33.0, < 2.33.8
git >= 2.34.0, < 2.34.8
git >= 2.35.0, < 2.35.8
git >= 2.36.0, < 2.36.6
git >= 2.37.0, < 2.37.7
git >= 2.38.0, < 2.38.5
git >= 2.39.0, < 2.39.3
git >= 2.40.0, < 2.40.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available