{"action":"Upgrade github.com/git-lfs/git-lfs to 2.1.1-0.20170519163204-f913f5f9c7c6 or later.","affected":[{"fixed":"2.1.1-0.20170519163204-f913f5f9c7c6","introduced":"0"}],"component":"github.com/git-lfs/git-lfs","cve_ids":["CVE-2017-17831"],"ecosystem":"Go","epss":0.03677,"exploited":false,"fixed_versions":["2.1.1-0.20170519163204-f913f5f9c7c6"],"ghsa_id":"GHSA-w4xh-w33p-4v29","id":"tcs_01M5KFQ4ZAX1Z9R8DDH3XMTGE0","modified_at":"2024-05-20T19:55:20Z","published_at":"2022-05-14T00:55:16Z","references":["https://osv.dev/vulnerability/GHSA-w4xh-w33p-4v29","https://nvd.nist.gov/vuln/detail/CVE-2017-17831","https://github.com/git-lfs/git-lfs/pull/2241","https://github.com/git-lfs/git-lfs/pull/2242","https://github.com/git-lfs/git-lfs/commit/f913f5f9c7c6d1301785fdf9884a2942d59cdf19","https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html","https://github.com/git-lfs/git-lfs","https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1","https://pkg.go.dev/vuln/GO-2021-0073","https://web.archive.org/web/20200227131639/http://www.securityfocus.com/bid/102926","http://blog.recurity-labs.com/2017-08-10/scm-vulns","http://www.securityfocus.com/bid/102926"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-w4xh-w33p-4v29","url":"https://osv.dev/vulnerability/GHSA-w4xh-w33p-4v29"}],"summary":"GitHub Git LFS Arbitrary command execution vulnerability"}