CVE-2018-17456

CRITICAL ⚠ Exploit

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "gi...

Affects 11 products across 4 vendors.

CVSS 3.09.8
EPSS97.4%
Percentile100th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-88: CWE-88
Related Attack Patterns (CAPEC)
CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads
via CWE-88
CAPEC-174 Flash Parameter Injection
via CWE-88
CAPEC-460 HTTP Parameter Pollution (HPP)
via CWE-88
CAPEC-88 OS Command Injection
via CWE-88
CAPEC-137 Parameter Injection
via CWE-88

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Git versions prior to 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 are vulnerable to remote code execution via a malicious .gitmodules file during a recursive 'git clone' operation.

BSID: BS-2018-GLOBAL-211579-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-17456?
Git versions prior to 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 are vulnerable to remote code execution via a malicious .gitmodules file during a recursive 'git clone' operation.
What is the CVSS score for CVE-2018-17456?
CVE-2018-17456 has CVSS 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 97.4%.
Is CVE-2018-17456 actively exploited?
Public exploit available for CVE-2018-17456. Exploitation risk elevated.
How do I remediate CVE-2018-17456?
Priority: IMMEDIATE.
What systems are affected by CVE-2018-17456?
CVE-2018-17456 affects Canonical Ubuntu Linux; Debian Debian Linux; Git-Scm Git; Redhat Enterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Server Tus, Ansible Tower, Enterprise Linux Desktop (plus 1 more product).
Vulnerability Details
CVE IDCVE-2018-17456
BSIDBS-2018-GLOBAL-211579-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2018-10-06
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-88
SourceNVD
Official Description

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can craft a .gitmodules file with a URL field starting with a '-' character, which can be used to execute arbitrary commands on the target system during the 'git clone' process.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Canonical Ubuntu Linux 14.04 16.04 18.04
Debian Debian Linux 9.0
Git-Scm Git ≥ 2.14.0, < 2.14.5 ≥ 2.15.0, < 2.15.3 ≥ 2.16.0, < 2.16.5 ≥ 2.17.0, < 2.17.2 ≥ 2.18.0, < 2.18.1 ≥ 2.19.0, < 2.19.1
Redhat Enterprise Linux Server 7.0
Redhat Enterprise Linux Workstation 7.0
Redhat Enterprise Linux Server Aus 7.6
Redhat Enterprise Linux Server Eus 7.6
Redhat Enterprise Linux Server Tus 7.6
Redhat Ansible Tower 3.3
Redhat Enterprise Linux Desktop 7.0
Redhat Enterprise Linux 6.0 6.7 7.0 7.3 7.4 7.5
+1 more7.6
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2931 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-25
Related CVEs affecting Canonical
CVE-2012-0444 10.0 Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 ... CVE-2012-3963 10.0 Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in M... CVE-2012-3961 10.0 Use-after-free vulnerability in the RangeData implementation in Mozilla Firef... CVE-2015-2724 10.0 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox... CVE-2017-16845 10.0 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during gue...
View all Canonical CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →