Eclipse Jgit vulnerabilities

3 CVEs affecting Eclipse Jgit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-4949, published 2025-05-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9390, published 2020-02-12. Critical severity, CVSS 9.8. EPSS: 75.6% chance of exploitation in the next 30 days. Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3;…
CVE-2023-4759, published 2023-09-12. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to…
CVE-2025-4949, published 2025-05-21. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol…