{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-27613",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-27613",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-07-10T14:58:16.752Z",
    "updatedAt": "2025-11-04T21:09:52.727Z",
    "importedAt": "2026-10-24T01:57:29.455Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Gitk can create and truncate files in the user's home directory",
      "summary": "Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.",
      "affected": [
        {
          "vendor": "j6t",
          "product": "gitk",
          "versions": [
            {
              "version": ">= 1.7.0, < 2.43.7",
              "status": "affected"
            },
            {
              "version": ">= 2.44.0, < 2.44.4",
              "status": "affected"
            },
            {
              "version": ">= 2.45.0, < 2.45.4",
              "status": "affected"
            },
            {
              "version": ">= 2.46.0, < 2.46.4",
              "status": "affected"
            },
            {
              "version": ">= 2.47.0, < 2.47.3",
              "status": "affected"
            },
            {
              "version": ">= 2.48.0, < 2.48.2",
              "status": "affected"
            },
            {
              "version": ">= 2.49.0, < 2.49.1",
              "status": "affected"
            },
            {
              "version": ">= 2.50.0, < 2.50.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}