Back to Database
Status published
High
CVE-2025-66413
Git for Windows leaks NTLM hash when cloning from an attacker-controlled server
Vulnerability Description
Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66413
Credits & Attribution
No credits recorded in the NVD database.
References
More from git-for-windows
View All →CVE-2023-29012
Git CMD erroneously executes `doskey.exe` in the current directory, if it exists
High
7.3
CVE-2023-29011
Git for Windows's config file of `connect.exe` is susceptible to malicious placing
High
7.6
CVE-2023-25815
Git looks for localized messages in the wrong place
Low
3.3
CVE-2023-23618
gitk can inadvertently call executables in the worktree
High
8.6
CVE-2023-22743
Git for Windows' installer is susceptible to DLL side loading attacks
High
7.3
Affected Vendor
git-for-windows
View all reports →Affected Software
git
Vulnerable Versions:
< 2.53.0(2)
Timeline
Official Publish:
March 10th, 2026
Last Modified:
March 11th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N