What is CVE-2014-9390?

CVE-2014-9390 is a critical-severity vulnerability in Apple Mac OS X, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2020-02-12.

How severe is CVE-2014-9390?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2014-9390 known to be exploited?

22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Apple Mac OS X

CVE-2014-9390

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2020-02-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.756 (99.5th percentile), scored 2026-10-17.

High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.756 · newest: 0.756 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

References

news.ycombinator.com/item (Patch, Third Party Advisory, Issue Tracking)
article.gmane.org/gmane.linux.kernel/1853266 (Broken Link)
git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html (Third Party Advisory)
mercurial.selenic.com/wiki/WhatsNew (Third Party Advisory, Release Notes)
support.apple.com/kb/HT204147 (Vendor Advisory)
github.com/blog/1938-git-client-vulnerability-announced (Vendor Advisory)
securitytracker.com/id (VDB Entry, Third Party Advisory)
github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915 (Third Party Advisory)
libgit2.org/security/ (Product)

Frequently asked questions

What is CVE-2014-9390?: CVE-2014-9390 is a critical-severity vulnerability in Apple Mac OS X, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2020-02-12.
How severe is CVE-2014-9390?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2014-9390 known to be exploited?: 22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.