Critical Vulnerability in Git Package: Untrusted Repository Cloning Risk
Summary
CVE-2025-27613: Gitk is a Tcl/Tk based Git history browser. Affects git versions < 2.43.7-r0. Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in their code and collaborate with others. It is essential for managing source code in software development. Gitk, a Tcl/Tk based Git history browser, provides a graphical interface for visualizing repository history. However, it has a vulnerability that can be exploited when users clone untrusted repositories, potentially leading to unauthorized file creation and truncation.
Vulnerability Detail
The vulnerability, identified as CVE-2025-27613, arises when a user clones an untrusted repository and runs gitk without additional command arguments. If the 'Support per-file encoding' option is enabled in Gitk's Preferences, files for which the user has write permission can be created and truncated. This issue can occur regardless of whether this option is enabled when using the 'Show origin of this line' feature. The vulnerability affects multiple versions of the Git package, and its exploitation could lead to data loss or unauthorized modifications in the user's file system.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid running gitk on untrusted repositories or ensure that the 'Support per-file encoding' option is disabled in Gitk's Preferences to mitigate the risk of unauthorized file creation.
Conclusion
The CVE-2025-27613 vulnerability in the Git package poses a significant risk when cloning untrusted repositories using gitk. Users are strongly advised to update to the latest patched versions to mitigate this risk. Additionally, employing workarounds can help reduce the likelihood of exploitation until an update can be applied.
See every vulnerability recorded for git →
FAQ
CVE-2025-27613 is a vulnerability in the Git package that allows unauthorized file creation and truncation when cloning untrusted repositories using gitk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1 are affected by this vulnerability.
If you cannot update Git immediately, avoid using gitk on untrusted repositories and disable the 'Support per-file encoding' option in Gitk's Preferences.
You can find more information about Git vulnerabilities on the official Git website and security advisories, as well as through vulnerability monitoring tools like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
