CVE-2025-66413

Published: Mar 10, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).

Affected (1)

Products: Gitforwindows: Git

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gitforwindows Git	Up to 2.53.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://github.com/git-for-windows/git/releases/tag/v2.53.0.windows.2

Source: security-advisories@github.com

Release Notes

https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.