Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade git-subtreeUpgrade gitUpgrade gitwebUpgrade gitkUpgrade git-credential-libsecretUpgrade git-coreUpgrade perl-Git-SVNUpgrade git-core-docUpgrade git-guiUpgrade git-allUpgrade git-daemonUpgrade git-emailUpgrade git-svnUpgrade perl-GitUpgrade git-instaweb | Jul 24, 2025 | Jul 10, 2025 |
| Alpine Linux | — | Upgrade git | Aug 8, 2025 | Jul 10, 2025 |
| Amazon Linux Ami 2 | — | Upgrade git-emailUpgrade git-guiUpgrade git-cvsUpgrade git-debuginfoUpgrade git-daemonUpgrade git-core-docUpgrade git-instawebUpgrade git-p4Upgrade git-allUpgrade gitkUpgrade perl-GitUpgrade git-subtreeUpgrade gitwebUpgrade perl-Git-SVNUpgrade git-coreUpgrade git-svnUpgrade git-credential-libsecretUpgrade git | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade git-credential-libsecretUpgrade git-debuginfoUpgrade git-subtreeUpgrade git-cvsUpgrade gitUpgrade gitkUpgrade perl-Git-SVNUpgrade git-credential-libsecret-debuginfoUpgrade git-emailUpgrade git-daemonUpgrade git-core-docUpgrade gitwebUpgrade git-p4Upgrade git-instawebUpgrade git-core-debuginfoUpgrade git-guiUpgrade git-daemon-debuginfoUpgrade git-svnUpgrade git-allUpgrade perl-GitUpgrade git-debugsourceUpgrade git-core | Jul 30, 2025 | Jul 8, 2025 |
| Debian | — | Upgrade git | Jul 10, 2025 | Jul 10, 2025 |
| Freebsd | — | Upgrade git-guiUpgrade git-p4Upgrade git-cvsUpgrade gitUpgrade git-svn | Dec 10, 2025 | Jul 8, 2025 |
| Gentoo Linux | — | Upgrade dev-vcs/git. | Jul 9, 2025 | Jul 8, 2025 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.12 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.8 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2022 to the latest version in the current channel channel.Update Microsoft Visual Studio 2022 to the latest version in the LTSC 17.10 version stream, or upgrade to a newer supported version of Visual Studio 2022.Update Microsoft Visual Studio 2017 to the latest version in the LTSC 15.9 version stream, or upgrade to a newer supported version of Visual Studio 2017. | Jul 10, 2025 | Jul 8, 2025 |
| Oracle_linux | — | Upgrade git-coreUpgrade git-subtreeUpgrade git-emailUpgrade git-core-docUpgrade perl-Git-SVNUpgrade gitkUpgrade gitUpgrade gitwebUpgrade git-credential-libsecretUpgrade git-svnUpgrade git-allUpgrade perl-GitUpgrade git-daemonUpgrade git-guiUpgrade git-instaweb | Jul 23, 2025 | Jul 8, 2025 |
| Redhat_linux | — | Upgrade git-credential-libsecret-debuginfoUpgrade git-coreUpgrade perl-GitUpgrade git-svnUpgrade git-credential-libsecretUpgrade git-instawebUpgrade git-daemonUpgrade git-guiUpgrade git-allUpgrade gitUpgrade git-core-debuginfoUpgrade git-core-docUpgrade perl-Git-SVNNo solution existsUpgrade gitkUpgrade git-debuginfoUpgrade git-debugsourceUpgrade git-subtreeUpgrade gitwebUpgrade git-emailUpgrade git-daemon-debuginfo | Jul 14, 2025 | Jul 10, 2025 |
| Rocky_linux | — | Upgrade git-debuginfoUpgrade git-subtreeUpgrade git-credential-libsecret-debuginfoUpgrade git-daemonUpgrade git-core-debuginfoUpgrade git-credential-libsecretUpgrade gitUpgrade git-debugsourceUpgrade git-daemon-debuginfoUpgrade git-core | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade git-lfsUpgrade git-coreUpgrade git-credential-libsecretUpgrade git-svnUpgrade git-webUpgrade git-archUpgrade perl-GitUpgrade git-daemonUpgrade git-docUpgrade gitUpgrade git-cvsUpgrade git-guiUpgrade git-emailUpgrade git-p4Upgrade gitk | Dec 5, 2025 | Jul 22, 2025 |
| Ubuntu | — | Upgrade gitUpgrade gitkUpgrade git-gui (Ubuntu Pro)Upgrade gitk (Ubuntu Pro)Upgrade git-guiUpgrade git (Ubuntu Pro) | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub