CVE-2021-21300: RCE via symlink in Git clone

RCE in Git during clone on case-insensitive filesystems via symlink and clean/smudge filter. CVSS 8.0.

CVE-2021-21300 is a remote code execution vulnerability in Git affecting clone operations on case-insensitive filesystems such as NTFS, HFS+, and APFS—the default filesystems on Windows and macOS. The vulnerability is triggered when a repository contains symbolic links combined with clean/smudge filters (typically Git LFS) configured globally: a cleanup or smudge script can be forced to execute at checkout time, with arbitrary code running in the user's context. Git for Windows configures Git LFS by default, making the vulnerability immediately exploitable on Windows without additional setup.

The CVSS score is 8.0 (high). Official patches were released on March 9, 2021, and the vulnerability exists from Git 2.14.2 onwards. Research continues: a recent GitHub signal (November 2026) documents an in-memory model of the lstat cache to analyze the vulnerability's mechanics, confirming that the community maintains scientific and defensive interest in the topic. No active exploit is reported, but the simplicity of the attack—a specially crafted repository is sufficient—made the flaw relevant from discovery.

Defense consists of upgrading Git to corrected versions (2.30.1 or later in your major branch). If immediate upgrade is not feasible, disabling symbolic link support globally or avoiding configuration of clean/smudge filters before cloning blocks the attack. Golden rule: clone only from trusted repositories and, where possible, validate code integrity and provenance. For IT teams and CISOs: verify that all Windows/macOS development systems are on patched versions, especially if Git LFS is used.

At a glance

What: CVE-2021-21300 is a remote code execution (RCE) vulnerability in Git triggered during clone operations on case-insensitive filesystems (NTFS, HFS+, APFS). The vulnerability exploits a combination of symbolic links and clean/smudge filters (e.g., Git LFS) to execute arbitrary scripts during checkout, with Git for Windows vulnerable by default.
Severity: CVSS 8.0 (high). The impact is significant for users cloning from untrusted repositories on Windows or macOS, resulting in arbitrary code execution in the Git user's context. Git LFS is configured by default in Git for Windows, amplifying exposure.
Affected versions: From version 2.14.2 through pre-patch releases. Fixed versions: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.6.
Fix: Patch versions released on March 9, 2021: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.6. Immediate upgrade recommended on all affected systems.
Status: Patches available and consolidated for 5 years (since March 2021). Recent GitHub signal (November 2026) documents in-memory lstat cache model to analyze vulnerability mechanics, confirming ongoing interest in defensive research. No public exploit reported in available data.
Action: Update Git to patched version. Workaround: disable symbolic link support globally or avoid configuring clean/smudge filters before clone. Both approaches block the attack. Best practice: clone only from trusted repositories and validate code integrity and provenance. For IT teams and CISOs: verify that all Windows/macOS development systems are on patched versions, especially if Git LFS is used.

Sources: NVD, CVE-2021-21300

← All articles