JLSEC-2025-182

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-182.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-182.json
JSON Data
https://api.test.osv.dev/v1/vulns/JLSEC-2025-182
Upstream
Published
2025-10-21T19:17:09.363Z
Modified
2025-11-03T00:18:43.814588Z
Summary
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0
Details

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.

Database specific 
{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "modified": "2024-11-21T04:59:26.073Z",
            "id": "CVE-2020-12278",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-12278",
            "imported": "2025-10-21T17:12:53.516Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12278",
            "published": "2020-04-27T17:15:13.407Z"
        }
    ]
}
References

Affected packages

Julia / LibGit2_jll

Package

Name
LibGit2_jll
Purl
pkg:julia/LibGit2_jll?uuid=e37daf67-58a4-590a-8e99-b0245dd2ffc5

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.28.5+0