CVE-2017-14867: Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14...

Security readout for executives and security teams

This is an older Git command-execution flaw. In affected Git versions, unsafe Perl helper scripts can let an attacker run operating-system commands through a crafted module name. The issue matters most on servers exposing Git access through git-shell, because the vulnerable path is reachable even without CVS support enabled. Exposure is most likely on older source-control or deployment servers running vulnerable Git versions and providing git-shell access. Workstations are lower priority unless untrusted users can trigger the vulnerable helper path. The source bundle does not provide CPEs or a complete affected product matrix. Prioritize remediation for internet-facing or shared Git servers. Although this CVE is old and no active exploitation is cited, arbitrary OS command execution in source-control infrastructure can threaten code integrity, credentials, and deployment pipelines. Mitigation focus: Upgrade Git to a fixed version or supported vendor package.; Prioritize servers exposing git-shell or Git access to external users.; Restrict git-shell access where it is not required..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.