CVE-2019-1348

LOW

Affects 2 products across 2 vendors.

CVSS 3.13.3

EPSS0.4%

Percentile35th

PatchPatched

CVSS Vector — Plain English Requires local access, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no availability impact.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in Git versions prior to v2.24.1 allows for arbitrary file overwriting through the --export-marks option in git fast-import, which can be exploited via the in-stream command feature.

BSID: BS-2020-GLOBAL-196919-L • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2019-1348?

A vulnerability in Git versions prior to v2.24.1 allows for arbitrary file overwriting through the --export-marks option in git fast-import, which can be exploited via the in-stream command feature.

What is the CVSS score for CVE-2019-1348?

CVE-2019-1348 has CVSS 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS: 0.4%.

Is CVE-2019-1348 actively exploited?

No confirmed active exploitation of CVE-2019-1348 as of 2026-05-30.

How do I remediate CVE-2019-1348?

Priority: HIGH.

What systems are affected by CVE-2019-1348?

CVE-2019-1348 affects Git-Scm Git; Opensuse Leap.

Vulnerability Details

CVE ID	`CVE-2019-1348`
BSID	`BS-2020-GLOBAL-196919-L` BreachSpider Global ID
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`
Published	2020-01-24
Last Modified	2024-11-21
ICS Relevance	0%
Source	NVD

Official Description

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can craft a malicious git fast-import stream that includes the export-marks command with a specially crafted path, leading to the overwriting of arbitrary files on the system with the permissions of the user running git.

Exploitation Likelihood: MEDIUM

Affected Products

Vendor	Product	Affected Versions
Git-Scm	Git	`≥ 2.14.0, < 2.14.6` `≥ 2.15.0, < 2.15.4` `≥ 2.16.0, < 2.16.6` `≥ 2.17.0, < 2.17.3` `≥ 2.18.0, < 2.18.2` `≥ 2.19.0, < 2.19.3` +5 more `≥ 2.20.0, < 2.20.2` `≥ 2.21.0, < 2.21.1` `≥ 2.22.0, < 2.22.2` `≥ 2.23.0, < 2.23.1` `≥ 2.24.0, < 2.24.1`
Opensuse	Leap	`15.1`

Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 2456 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`/workspace/models/qwen2.5-coder-32b-instruct-bf16`
Confidence	HIGH
Enriched At	2026-05-24
SHA-512 Audit Hash	`ac0f867cc276532a0bb6776fc1649e235924847fe9e8488abe5212b5bbb7d3b92ccdc6cea85bf5539d0380e7321cfeaa5bde6ec6c480f7bfaa769b22e8a65b36`

Related CVEs affecting Git-Scm

CVE-2018-17456 9.8 Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before ... CVE-2018-19486 9.8 Git before 2.19.2 on Linux and UNIX executes commands from the current workin... CVE-2016-2324 9.8 Integer overflow in Git before 2.7.4 allows remote attackers to execute arbit... CVE-2016-2315 9.8 revision.c in git before 2.7.4 uses an incorrect integer data type, which all... CVE-2019-1353 9.8 An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2,...

View all Git-Scm CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →