Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6wax-pt19-2bed
Vulnerability ID VCID-6wax-pt19-2bed
Aliases CVE-2019-19604
Summary git: Recursive clone followed by a submodule update could execute code contained within repository without the user explicitly consent
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-807 Reliance on Untrusted Inputs in a Security Decision
System Score Found at
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19604.json
epss 0.01562 https://api.first.org/data/v1/epss?cve=CVE-2019-19604
archlinux High https://security.archlinux.org/AVG-1073
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19604.json
https://api.first.org/data/v1/epss?cve=CVE-2019-19604
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19604
1781971 https://bugzilla.redhat.com/show_bug.cgi?id=1781971
ASA-201912-6 https://security.archlinux.org/ASA-201912-6
AVG-1073 https://security.archlinux.org/AVG-1073
GLSA-202003-30 https://security.gentoo.org/glsa/202003-30
USN-4220-1 https://usn.ubuntu.com/4220-1/
No exploits are available.
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19604.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.81786
EPSS Score 0.01562
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T09:29:20.942511+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19604.json 38.6.0