CVE-2010-3906: Git

Medium severity, CVSS 4.3. EPSS: 5.6% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters.

Affected products

• Git Git: version 0.99.9j only; version 0.99.9k only; version 0.99.9l only; version 0.99.9m only; version 0.99.9n only; version 1.0.0 only; …
• Git-Scm Git: up to and including 1.7.3.3; version 0.01 only; version 0.02 only; version 0.03 only; version 0.04 only; version 0.5 only; …

Published 2010-12-17. Last modified 2026-06-16.