Critical Vulnerability in Git Package: Remote Code Execution Risk via Gitk
Summary
ALPINE-CVE-2025-27614: Gitk is a Tcl/Tk based Git history browser. Affects git versions < 2.43.7-r0. Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in their codebase efficiently. It is essential for collaborative software development, providing features such as branching, merging, and history tracking. Gitk, a graphical history browser for Git, enables users to visualize repository changes. However, starting from version 2.41.0, Gitk has been found to be vulnerable to a security flaw that could allow an attacker to execute arbitrary scripts on a user's machine.
Vulnerability Detail
The vulnerability arises from the way Gitk processes certain filenames within a Git repository. An attacker can craft a repository that, when cloned and accessed through Gitk, can trick the user into executing malicious scripts. This is achieved through social engineering, where the user is led to invoke Gitk with a specially structured filename. The scripts run with the user's privileges, potentially leading to unauthorized access or data manipulation.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid invoking Gitk with filenames that may be crafted by an attacker. It is advisable to review the repository's structure and ensure that no untrusted scripts are executed.
Conclusion
The vulnerability in Gitk poses a significant risk by allowing remote code execution through social engineering tactics. Users are strongly advised to update their Git installations to the latest patched versions to mitigate this risk. Awareness and caution when using Gitk with untrusted repositories can further enhance security.
See every vulnerability recorded for git →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts on a user's machine by tricking them into using Gitk with specially crafted filenames.
You can check your Git version using the command git --version. If it is below the patched versions, it is vulnerable.
If an immediate update is not possible, avoid using Gitk with untrusted repositories or filenames until you can apply the patch.
Yes, tools like Vulert can monitor your project for open-source vulnerabilities in real-time using just a manifest file.
Detailed information can be found in the CVE database and the official Git release notes regarding the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
