CVE-2019-1353

CRITICAL

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also kno...

Affects 2 products across 2 vendors.

CVSS 3.19.8
EPSS2.2%
Percentile83th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in Git versions prior to v2.24.1 allows for bypassing NTFS protections when accessing a working directory on a Windows drive from within the Windows Subsystem for Linux (WSL). This can lead to unauthorized access and manipulation of files.

BSID: BS-2020-GLOBAL-196920-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-1353?
A critical vulnerability in Git versions prior to v2.24.1 allows for bypassing NTFS protections when accessing a working directory on a Windows drive from within the Windows Subsystem for Linux (WSL). This can lead to unauthorized access and manipulation of files.
What is the CVSS score for CVE-2019-1353?
CVE-2019-1353 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 2.2%.
Is CVE-2019-1353 actively exploited?
No confirmed active exploitation of CVE-2019-1353 as of 2026-09-25.
How do I remediate CVE-2019-1353?
Priority: IMMEDIATE.
What systems are affected by CVE-2019-1353?
CVE-2019-1353 affects Git-Scm Git; Opensuse Leap.
Vulnerability Details
CVE IDCVE-2019-1353
BSIDBS-2020-GLOBAL-196920-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2020-01-24
Last Modified2026-06-17
ICS Relevance0%
SourceNVD
Official Description

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker with access to a Windows machine running WSL and Git can exploit this vulnerability to bypass NTFS permissions, potentially leading to unauthorized file access or modification. This is particularly concerning in environments where sensitive data is stored on Windows drives and accessed via WSL.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Git-Scm Git ≥ 2.14.0, < 2.14.6 ≥ 2.15.0, < 2.15.4 ≥ 2.16.0, < 2.16.6 ≥ 2.17.0, < 2.17.3 ≥ 2.18.0, < 2.18.2 ≥ 2.19.0, < 2.19.3
+5 more≥ 2.20.0, < 2.20.2 ≥ 2.21.0, < 2.21.1 ≥ 2.22.0, < 2.22.2 ≥ 2.23.0, < 2.23.1 ≥ 2.24.0, < 2.24.1
Opensuse Leap 15.1
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2456 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash2fcfae586c37e16848f233becc7d3779aa4b03870a32a0d476106cf4245a4f3a29664de4c1858543da8f11388f5b3ccdb42700bea8547c07044ddd0b5b60e071
Related CVEs affecting Git-Scm
CVE-2018-17456 9.8 Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before ... CVE-2018-19486 9.8 Git before 2.19.2 on Linux and UNIX executes commands from the current workin... CVE-2016-2324 9.8 Integer overflow in Git before 2.7.4 allows remote attackers to execute arbit... CVE-2016-2315 9.8 revision.c in git before 2.7.4 uses an incorrect integer data type, which all... CVE-2014-9390 9.8 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1....
View all Git-Scm CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →