CVE-2023-22743: git_for_windows_project git_for_windows Untrusted Search Path
Vulnerability summary
CVE-2023-22743 is a high (CVSS 7.3) Untrusted Search Path vulnerability in git_for_windows_project git_for_windows. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 14-02-2023PublishedVulnerability first disclosed.
- 10-03-2025Last modifiedVulnerability information updated.
Description
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · WolfiEcosystem advisory · calculated7.2HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated7.2HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- NVDNIST7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
0.00 pp
From 0.35% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- gitAll versions (No fix recorded)
Git_for_windows_project1 product
- git_for_windows< 2.39.2
Git-for-windows1 product
- git< 2.39.2
Wolfi1 product
- gitAll versions (No fix recorded)
4 vendors · 4 products
References
8 links- github.com/git-for-windows/git/security/advisories/GHSA-p2x9-prp4-8gvqX Refsource CONFIRMAdvisoryVendor Advisory
- github.com/git-for-windows/git/security/advisories/GHSA-gf48-x3vr-j5c3X Refsource MISCAdvisoryVendor Advisory
learn.microsoft.com/en-us/windows/win32/controls/cookbook-overview?redirectedfrom=MSDNX Refsource MISCWEBPatchTechnical DescriptionVendor Advisory- learn.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies-X Refsource MISCWEBPatchTechnical DescriptionVendor Advisory
