Critical Vulnerability in Git Package: Remote Code Execution Risk via Gitk
Summary
UBUNTU-CVE-2025-27614: Gitk is a Tcl/Tk based Git history browser. Affects git versions < 1:2.43.0-1ubuntu7.3. Fixed in 1:2.43.0-1ubuntu7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in their code and collaborate with others. Gitk is a graphical history browser for Git repositories, built using Tcl/Tk. This package is essential for visualizing project history and managing version control effectively. However, it has been found to have a serious vulnerability that can be exploited by malicious actors.
Vulnerability Detail
The vulnerability, identified as CVE-2025-27614, arises from the way Gitk processes certain Git repository structures. Starting from version 2.41.0, an attacker can craft a repository that, when cloned and accessed by a user through Gitk, can execute arbitrary scripts (such as Bourne shell, Perl, or Python scripts) with the user's privileges. This poses a significant risk as it can lead to unauthorized access, data manipulation, or system compromise.
How To Fix
Minimum fixed version
1:2.43.0-1ubuntu7.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users should avoid using Gitk on repositories from untrusted sources. Additionally, users can disable script execution in their environment to prevent any unintended script execution.
Conclusion
The CVE-2025-27614 vulnerability in the Git package poses a significant risk through the Gitk interface, allowing for potential remote code execution. It is essential for users to update their Git installations to the latest patched versions to safeguard against exploitation. Awareness and proactive measures are key to maintaining security.
See every vulnerability recorded for git →
FAQ
CVE-2025-27614 is a vulnerability in the Git package that allows for remote code execution through the Gitk interface.
If you are using Git version 2.41.0 or later, you should check if you are running a patched version (2.43.7 or higher) to ensure you are not vulnerable.
Exploitation of this vulnerability can lead to unauthorized script execution, which may compromise system security and data integrity.
Yes, tools like Vulert can monitor your applications for open-source vulnerabilities in real-time using just a manifest file.
You can find detailed information about CVE-2025-27614 on the official Ubuntu security notices page or through vulnerability databases.
Related vulnerabilities
Recent vulnerabilities recorded for git.
