Critical Vulnerability in Git Package: Risk of Malicious Executables Execution
Summary
CVE-2025-46334: Git GUI allows you to use the Git source control management tools via a GUI. Affects git versions < 2.43.7-r0. Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that enables developers to manage and track changes in their codebase. It provides a command-line interface as well as graphical user interfaces (GUIs) for ease of use. The Git GUI allows users to interact with Git repositories visually, making it accessible for users who may not be comfortable with command-line operations. However, this convenience comes with a security risk, as certain design flaws can expose users to malicious code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2025-46334, arises from the way Git GUI handles executable files in the Windows environment. When a user selects options like 'Git Bash' or 'Browse Files', the application searches for executables in the current directory, which can be exploited by a malicious repository. If a user clones a repository containing a malicious version of sh.exe or a text conversion filter, it could lead to unintended execution of harmful code. This vulnerability can compromise the user's system, leading to data breaches or unauthorized access.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid executing Git commands from untrusted repositories or ensure that the current directory does not contain any executable files that could be malicious. Additionally, users can manually check the contents of the repository before executing any commands.
Conclusion
In summary, CVE-2025-46334 poses a significant risk to users of the Git package due to the potential execution of malicious executables. It is essential to update to the latest patched versions to mitigate this vulnerability and to exercise caution when working with untrusted repositories.
See every vulnerability recorded for git →
FAQ
CVE-2025-46334 is a vulnerability in the Git package that allows malicious executables to be executed due to the way Git GUI handles the current directory in Windows.
You can check your Git version by running 'git --version' in your terminal. If it is below the patched versions listed, it is vulnerable.
The risks include the potential execution of malicious code, which can lead to data loss, unauthorized access, or system compromise.
It is recommended to regularly check for updates and apply them promptly to ensure you are protected against known vulnerabilities.
Yes, Vulert can monitor your application for open-source vulnerabilities in real-time using just a manifest file like package-lock.json. You can check your application using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for git.
