This release introduces security fixes for four vulnerabilities that have been assigned the identifiers CVE-2026-69260, CVE-2026-69261, CVE-2026-105802, and CVE-2026-105803. These vulnerabilities apply to all of the operating systems supported by Git LFS.
- CVE-2026-69260:
When Git LFS sends a remote command via SSH, it does not properly format the argument it derives from the remote SSH URL. Servers which pass remote commands to a shell without sanitizing their arguments may be induced to execute malicious programs.
Git LFS has resolved this problem by fully quoting the arguments of the remote commands it sends via SSH.
- CVE-2026-69261:
After receiving an HTTP redirection, Git LFS may forward Cookie headers to a host other than the one for which they were intended. If credentials or other secrets are stored in HTTP cookies, they may be leaked to a potentially malicious host.
Git LFS has resolved this issue by only sending Cookie headers to the hosts for which they were intended.
- CVE-2026-105802:
When operating in a malicious repository which contains a submodule, Git LFS may execute an arbitrary program after incorrectly parsing line feed (LF) characters in the submodule's URL.
Git LFS has resolved this issue by always using an unambiguous format to read and parse Git configuration options.
- CVE-2026-105803:
When operating in a malicious repository, Git LFS may execute an
arbitrary program as a custom transfer adapter after incorrectly
filtering the options defined in an .lfsconfig file.
Git LFS has resolved this issue by restricting the configuration of custom object transfer commands to local sources.
As well as the changes listed above, Git LFS has resolved a problem with its encoding of the HTTPS URL it checks when a remote SSH host either does not support Git LFS commands or does not return an HTTP URL in response to an authentication request.
We would like to extend a special thanks to the following security researchers for first reporting these issues to us in a responsible manner:
- @dungNHVhust (CVE-2026-69260)
- @izzysec (CVE-2026-105802)
- @jthack (CVE-2026-105803)
- @SnailSploit (CVE-2026-69261)
In addition, we would like to thank the following researchers who also reported these issues to us responsibly:
- Idan Bachar and Niv Levy (CVE-2026-105803)
- @bughunter0xff (CVE-2026-105802)
- @castilho101 (CVE-2026-105803)
- @douglasday (CVE-2026-105803)
- @evanconnelly (CVE-2026-105803)
- @Hexix23 (CVE-2026-105803)
- @izzysec (CVE-2026-69260)
- Yonghwa Lee (Theori) (CVE-2026-105803)
- Rojan Rijal (Ophion Security/Anthropic) (CVE-2026-105803)
- @SAYUTIM (CVE-2026-69260)
Bugs
- Parse configuration options unambiguously (@chrisd8088, @aniketgup)
- Use strict matching for custom transfer configuration options (@chrisd8088, @aniketgup)
- Limit protected HTTP headers to same origin (@aniketgup, @chrisd8088)
- Fix shell quoting of paths with SSH (@bk2204, @chrisd8088)
Misc
- Update some Linux workflow jobs for Ubuntu 26.04 runners (@chrisd8088)
- Update code signing and notarization of macOS release assets (@chrisd8088)
- Fix Linux release package build and upload issues (@chrisd8088)
Packages
Up to date packages are available on PackageCloud and Homebrew.
RPM RHEL 8/Rocky Linux 8 RPM RHEL 9/Rocky Linux 9 RPM RHEL 10/Rocky Linux 10 Debian 11 (AMD64) Debian 11 (ARM64) Debian 12 (AMD64) Debian 12 (ARM64) Debian 13 (AMD64) Debian 13 (ARM64)
SHA-256 hashes:
git-lfs-darwin-amd64-v3.8.1.zip 4292b3518e717e53c20a6c2c0696e2069a21e97500ad14b80b06bd52de8f3b72
git-lfs-darwin-arm64-v3.8.1.zip 0ba10e897e0496412cd86eacaed4ed554c97ddc29bc5c709d28faa5eaaa2222c
git-lfs-freebsd-386-v3.8.1.tar.gz 76398b95eff2281e7d3088f8677ec548d13d6b08f553f2af573506b84767264c
git-lfs-freebsd-amd64-v3.8.1.tar.gz acbd1d6f93d9578be358ce12a9c699ffb6b2e082f744c7bb8ec033e706375ded
git-lfs-linux-386-v3.8.1.tar.gz 42d862b5cad499820fde9ea6c3080c73327f679f1968eb4a3e71fa11d8737d26
git-lfs-linux-amd64-v3.8.1.tar.gz e72cf723a4a660438862282e8aecf3885fc8123e88bfcad534cf6b941a354b75
git-lfs-linux-arm-v3.8.1.tar.gz 51850fba78f08c8ffe86e162ce277a36fb41929ba699c2853f4b0ff178cf0eb2
git-lfs-linux-arm64-v3.8.1.tar.gz 67895dd77b63329796bc5efdd47b57f218e1f7b98717ebaf936a8238dbcaec0f
git-lfs-linux-loong64-v3.8.1.tar.gz b2fbba542d9171b7975ce25a6193f6240e12f1544dd589ee54959a6ee6137da7
git-lfs-linux-ppc64le-v3.8.1.tar.gz 9ef81f07d069fc47d444c2b79a3babb65ece384cdae48c4bfd88e1ad0d972aea
git-lfs-linux-riscv64-v3.8.1.tar.gz 747d7c5036d9655aed66219aec83716a2090a60cdeb49eb099784ee65a5c2912
git-lfs-linux-s390x-v3.8.1.tar.gz ca6a94c9e44b422bdef9575ac8153e1c0361508d8610f9b5be114c066a9d5cfd
git-lfs-v3.8.1.tar.gz 1939307bef808580f7c8954ede7072889d7e76721f5d6fdc4ab110bf907330ab
git-lfs-vendor-v3.8.1.tar.gz 8c25df445c8cb818846d851cceef653333c90eb638f7f2ac4d5ba2db70cd1830
git-lfs-windows-386-v3.8.1.zip d036588bd9027b7bf2a57e9fcb476ab95880f078d9b0a622869f397fb9030088
git-lfs-windows-amd64-v3.8.1.zip 5bb771c12b3dacc535e912d0270a010c209d4da2e63819c5918e3547c2defed9
git-lfs-windows-arm64-v3.8.1.zip 7e70990e339efab3e793affb919355b548c9a41c5b6bb52d90267bcb84ba4784
git-lfs-windows-v3.8.1.exe 7ac0422468f9cce06a7916156ed284f223527ed40e6d9ccf5fc0e89ad05b389c
hashes.asc d55d49188f51ff23d8ed04fb0fb7e08b0f14c8466d6c87215cde85c9674c73f8
sha256sums.asc b648ddbf8cd768e4d9dc9db4ac7c15dd3830d7ef00cba86c614a5f9b5ba9b9f4
