Git for Windows versions older than 2.53.0.windows.3 allow an attacker to obtain a user’s NTLM hash by tricking the user into cloning a malicious repository or checking out a malicious branch. The clone operation contacts an attacker-controlled Git server and, via default NTLM authentication, streams the user’s NTLM credentials to the server without requiring any user interaction. The leaked hash can then be brute forced, enabling credential compromise. This vulnerability is an information disclosure flaw (CWE-200).

Git for Windows, product "Git". Users running any Git for Windows release prior to 2.53.0.windows.3 are affected. Versions 2.53.0.windows.3 and later contain the fix.

The vulnerability scores a high CVSS of 7.4. EPSS is not reported, indicating that the exploitation probability is not quantified, but the issue is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote: any actor who can host or trick a user into interacting with a malicious Git server can exploit this flaw. Exploitation requires only that the user run "git clone" or similar commands against the attacker-controlled endpoint. The consequences include potential credential theft and downstream compromise of any resources accessed with those credentials.