Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gitUpgrade git-subtreeUpgrade git-coreUpgrade perl-Git-SVNUpgrade gitwebUpgrade gitkUpgrade git-credential-libsecretUpgrade git-guiUpgrade git-core-docUpgrade git-svnUpgrade git-daemonUpgrade git-emailUpgrade git-instawebUpgrade git-allUpgrade perl-Git | Jul 24, 2025 | Jul 10, 2025 |
| Alpine Linux | — | Upgrade git | Aug 8, 2025 | Jul 10, 2025 |
| Amazon Linux Ami 2 | — | Upgrade git-debuginfoUpgrade git-daemonUpgrade git-guiUpgrade git-cvsUpgrade git-p4Upgrade git-allUpgrade git-emailUpgrade git-core-docUpgrade git-instawebUpgrade gitkUpgrade perl-GitUpgrade gitUpgrade git-coreUpgrade perl-Git-SVNUpgrade git-svnUpgrade git-subtreeUpgrade gitwebUpgrade git-credential-libsecret | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade git-emailUpgrade git-credential-libsecretUpgrade git-credential-libsecret-debuginfoUpgrade git-cvsUpgrade gitkUpgrade git-debuginfoUpgrade git-subtreeUpgrade perl-Git-SVNUpgrade gitUpgrade git-core-docUpgrade git-guiUpgrade git-core-debuginfoUpgrade git-allUpgrade perl-GitUpgrade git-svnUpgrade git-coreUpgrade git-p4Upgrade git-daemonUpgrade git-instawebUpgrade git-daemon-debuginfoUpgrade gitwebUpgrade git-debugsource | Jul 30, 2025 | Jul 8, 2025 |
| Debian | — | Upgrade gitNo solution exists | Jul 10, 2025 | Jul 10, 2025 |
| Freebsd | — | Upgrade git-p4Upgrade git-guiUpgrade git-svnUpgrade gitUpgrade git-cvs | Dec 10, 2025 | Jul 8, 2025 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Jul 9, 2025 | Jul 8, 2025 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2017 to the latest version in the LTSC 15.9 version stream, or upgrade to a newer supported version of Visual Studio 2017.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.10 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the current channel channel.Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.8 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.12 version stream, or upgrade to a newer supported version of Visual Studio 2022. | Jul 10, 2025 | Jul 8, 2025 |
| Oracle_linux | — | Upgrade git-credential-libsecretUpgrade git-instawebUpgrade perl-GitUpgrade git-guiUpgrade git-svnUpgrade git-allUpgrade git-daemonUpgrade gitUpgrade perl-Git-SVNUpgrade git-coreUpgrade gitkUpgrade git-core-docUpgrade git-emailUpgrade git-subtreeUpgrade gitweb | Jul 23, 2025 | Jul 8, 2025 |
| Redhat_linux | — | Upgrade git-core-debuginfoUpgrade gitwebUpgrade gitkUpgrade git-debugsourceNo solution existsUpgrade git-emailUpgrade git-core-docUpgrade git-debuginfoUpgrade git-subtreeUpgrade git-daemon-debuginfoUpgrade perl-Git-SVNUpgrade gitUpgrade git-svnUpgrade git-credential-libsecretUpgrade git-allUpgrade git-credential-libsecret-debuginfoUpgrade git-instawebUpgrade git-coreUpgrade git-daemonUpgrade git-guiUpgrade perl-Git | Jul 14, 2025 | Jul 10, 2025 |
| Rocky_linux | — | Upgrade git-daemon-debuginfoUpgrade gitUpgrade git-credential-libsecretUpgrade git-coreUpgrade git-debugsourceUpgrade git-daemonUpgrade git-debuginfoUpgrade git-credential-libsecret-debuginfoUpgrade git-core-debuginfoUpgrade git-subtree | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade git-emailUpgrade git-p4Upgrade git-cvsUpgrade gitkUpgrade git-guiUpgrade perl-gitUpgrade git-coreUpgrade git-docUpgrade git-webUpgrade git-credential-libsecretUpgrade git-archUpgrade git-daemonUpgrade git-svnUpgrade gitUpgrade git-lfs | Dec 5, 2025 | Jul 22, 2025 |
| Ubuntu | — | Upgrade gitkUpgrade gitUpgrade git-gui (Ubuntu Pro)Upgrade git-guiUpgrade git (Ubuntu Pro)Upgrade gitk (Ubuntu Pro) | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub