Critical Vulnerability in Git Package: Risk of Malicious Executables in GUI
Summary
ALPINE-CVE-2025-46334: Git GUI allows you to use the Git source control management tools via a GUI. Affects git versions < 2.43.7-r0. Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to manage and track changes in their codebase. It provides a command-line interface as well as a graphical user interface (GUI) for ease of use. The Git GUI enables users to perform Git operations visually, making it accessible for those less familiar with command-line tools. However, due to a design flaw in Tcl on Windows, the Git GUI is vulnerable to exploitation through malicious repositories that can introduce harmful executables.
Vulnerability Detail
The vulnerability arises from the Git GUI's reliance on the current directory in its search path for executables. This means that if a user interacts with a malicious repository, it could contain harmful versions of executables like sh.exe or textconv filter programs. When a user selects options such as 'Git Bash' or 'Browse Files', these malicious executables could be invoked, leading to potential system compromise. This vulnerability has been identified as CVE-2025-46334 and affects multiple versions of the Git package across various Alpine Linux releases.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid executing Git commands from untrusted repositories or ensure that the current directory does not contain any potentially malicious executables before using the Git GUI.
Conclusion
The vulnerability identified as CVE-2025-46334 poses a significant risk to users of the Git package through its GUI. By understanding the nature of this vulnerability and taking appropriate steps to update or mitigate risks, users can protect their systems from potential exploitation.
See every vulnerability recorded for git →
FAQ
CVE-2025-46334 is a vulnerability in the Git package that allows malicious executables to be executed through the Git GUI due to a design flaw in Tcl on Windows.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions of Git prior to 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1 are affected by this vulnerability.
If you cannot update Git immediately, avoid using the Git GUI with untrusted repositories and ensure that your current directory does not contain any suspicious executables.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
