A critical information exposure vulnerability in Git for Windows allows unauthorized actors to access sensitive data due to improper resource handling.

The software suffers from CWE-200 and CWE-610, permitting an unauthenticated attacker to influence external references, which results in the unauthorized disclosure of sensitive information.

This vulnerability poses a significant risk to the confidentiality of development environments. An attacker could potentially gain access to credentials, configuration files, or sensitive source code, leading to intellectual property theft or further lateral movement into internal systems. The CVSS score of 7.4 reflects the high impact on data confidentiality.

Immediate Action: Upgrade to Git for Windows version 2.55.0.windows.4 or later to apply the necessary security fixes.

Proactive Monitoring: Audit access logs for unusual git operations and monitor for unauthorized attempts to access configuration or repository files.

Compensating Controls: Implement strict file system permissions and ensure that git repositories are not exposed to untrusted users or processes.

Public Exploit Available: false

Given the central role of Git in software development workflows, this vulnerability should be addressed with high priority. All developers and automated build pipelines utilizing Git for Windows must be updated to version 2.55.0.windows.4 to mitigate the risk of information leakage.