JLSEC-2025-183

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-183.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-183.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2025-183

Upstream

CVE-2020-12279

Published

2025-10-21T19:17:09.363Z

Modified

2026-07-18T18:24:23.278790989Z

Severity

7.5 (High) CVSS_V2 - AV:N/AC:L/Au:N/C:P/I:P/A:P CVSS Calculator
9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0

Details

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Database specific

{
    "sources": [
        {
            "modified": "2026-06-17T02:51:33.510Z",
            "database_specific": {
                "status": "Modified"
            },
            "published": "2020-04-27T17:15:13.470Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-12279",
            "imported": "2026-07-17T20:42:10.622Z",
            "id": "CVE-2020-12279",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12279"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / LibGit2_jll

Package

Name: LibGit2_jll
Purl: pkg:julia/LibGit2_jll?uuid=e37daf67-58a4-590a-8e99-b0245dd2ffc5

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.28.5+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-183.json"