Critical Vulnerability in Git GUI: Potential File Overwrite Risk
Summary
ALPINE-CVE-2025-46835: Git GUI allows you to use the Git source control management tools via a GUI. Affects git versions < 2.43.7-r0. Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to manage and track changes in their code. The Git GUI provides a graphical interface for users to interact with Git repositories. This package is essential for developers who prefer a visual approach to source control management. However, it has been identified that the Git GUI can be exploited when users clone untrusted repositories, leading to potential security risks.
Vulnerability Detail
The vulnerability arises when a user clones an untrusted repository and is misled into editing files located in maliciously named directories within that repository. This can result in the Git GUI creating and overwriting files that the user has permission to modify. The implications of this vulnerability are significant, as it can lead to unauthorized changes to critical files, potentially compromising the integrity of the user's system.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid cloning untrusted repositories and be cautious when editing files within cloned repositories. Additionally, users can manually verify the contents of directories before making any changes.
Conclusion
The identified vulnerability in Git GUI poses a significant risk to users who clone untrusted repositories. It is crucial to update to the latest patched versions to mitigate this risk. Users are also encouraged to exercise caution when interacting with repositories and to utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for git →
FAQ
The vulnerability allows for potential file overwriting when users clone untrusted repositories and edit files in maliciously named directories.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions prior to the patched versions (2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1) are affected by this vulnerability.
If an immediate update is not possible, avoid cloning untrusted repositories and verify the contents of directories before editing files.
For real-time monitoring and alerts on open-source vulnerabilities, you can visit Vulert at https://vulert.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
