Critical Vulnerability in Git Package: File Manipulation Risk in Gitk
Summary
ALPINE-CVE-2025-27613: Gitk is a Tcl/Tk based Git history browser. Affects git versions < 2.43.7-r0. Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Git is a widely used version control system that allows developers to track changes in their code and collaborate with others. Gitk is a graphical history browser for Git, providing a visual representation of the repository's history. This tool is essential for users who prefer a GUI over command-line interactions. However, a recent vulnerability has been identified in Gitk that poses a significant risk when handling untrusted repositories.
Vulnerability Detail
The vulnerability arises from Gitk's handling of untrusted repositories. When a user clones such a repository and runs Gitk without any additional command arguments, it can create and truncate files for which the user has write permissions. This issue is particularly concerning as it can lead to unauthorized file manipulation, potentially compromising the integrity of the user's system. The vulnerability has been present since version 1.7.0 and affects users who have enabled the 'Support per-file encoding' option in Gitk's Preferences, which is disabled by default. The vulnerability has been assigned the identifier CVE-2025-27613.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised not to run Gitk on untrusted repositories without additional command arguments. Additionally, ensure that the 'Support per-file encoding' option is disabled in Gitk's Preferences to mitigate the risk.
Conclusion
The vulnerability CVE-2025-27613 in the Git package poses a significant risk to users who utilize Gitk for browsing Git history. It is crucial to update to the patched versions to ensure the security of your system. Users should also be cautious when handling untrusted repositories and consider using Vulert for real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for git →
FAQ
CVE-2025-27613 is a vulnerability in the Gitk tool that allows unauthorized file manipulation when cloning untrusted repositories.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability affects all versions of Git starting from 1.7.0 up to the fixed versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.
If an immediate update is not possible, avoid using Gitk on untrusted repositories and disable the 'Support per-file encoding' option in Preferences.
More information can be found in the official CVE database or by checking the Git release notes for the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
