CVE-2014-9390

CRITICAL

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3...

Affects 8 products across 6 vendors.

CVSS 3.19.8
EPSS75.6%
Percentile100th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 51
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

{ "executive_summary": "Vulnerabilities in Git and related tools allow remote Git servers to execute arbitrary commands on affected systems.", "attack_vector_detail": "An attacker can exploit this vulnerability by hosting a malicious Git repository that, when cloned or pulled by a vulnerable client, can execute arbitrary commands on the client's system.", "affected_components": [ "Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X", "Mercurial before 3.2.3 on Windows and OS X", "Apple Xcode before 6.2 beta 3", "libgit2 all versions up to 0.21.2", "Egit all versions before 08-12-2014", "JGit all versions before 08-12-2014" ], "exploitation_likelihood": "HIGH", "remediation_priority":

BSID: BS-2020-GLOBAL-186959-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2014-9390?
{ "executive_summary": "Vulnerabilities in Git and related tools allow remote Git servers to execute arbitrary commands on affected systems.", "attack_vector_detail": "An attacker can exploit this vulnerability by hosting a malicious Git repository that, when cloned or pulled by a vulnerable client, can execute arbitrary commands on the client's system.", "affected_components": [ "Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on
What is the CVSS score for CVE-2014-9390?
CVE-2014-9390 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 75.6%.
Is CVE-2014-9390 actively exploited?
No confirmed active exploitation of CVE-2014-9390 as of 2026-09-25.
How do I remediate CVE-2014-9390?
Priority: MEDIUM. Advisory: http://support.apple.com/kb/HT204147 PSIRT: [email protected]
What systems are affected by CVE-2014-9390?
CVE-2014-9390 affects Apple Xcode; Eclipse Egit, Jgit; Git-Scm Git; Libgit2 Libgit2; Mercurial Mercurial.
Vulnerability Details
CVE IDCVE-2014-9390
BSIDBS-2020-GLOBAL-186959-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2020-02-12
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
Improper Input Validation
SourceNVD
Official Description

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a g CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Apple Xcode 6.2 ≤ 6.1.1
Eclipse Egit < 08-12-2014
Eclipse Jgit < 3.4.2 ≥ 3.5.0, < 3.5.3
Git-Scm Git < 1.8.5.6 ≥ 1.9.0, < 1.9.5 ≥ 2.0.0, < 2.0.5 ≥ 2.1.0, < 2.1.4 ≥ 2.2.0, < 2.2.1
Libgit2 Libgit2 < 0.21.3
Mercurial Mercurial < 3.2.3

Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Apple Mac Os X, Microsoft Windows

Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2438 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash10b80432799239af0e79828b6c15630f7bbc70f4522fcd2342f6dbc540dd5866c922e85c9e1dbaffa782919c2d65b26afb2cb6714a68166e9d95b206c44fcca3
Related CVEs affecting Apple
CVE-2012-0751 10.0 The ActiveX control in Adobe Flash Player before 10.3.183.15 and 11.x before ... CVE-2011-2452 10.0 Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows,... CVE-2012-4151 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a... CVE-2012-4153 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a... CVE-2012-4159 10.0 Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows a...
View all Apple CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →