cveboard RSS feed

CVE-2025-27614

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Gitk allows arbitrary command execution

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

gitk

Vendor
j6t
Product
gitk
Platforms
Unknown
Default status
Unknown
gitk · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 2.41.0, < 2.43.7affectedUnavailableUnavailableUnavailableNone listed
>= 2.44.0, < 2.44.4affectedUnavailableUnavailableUnavailableNone listed
>= 2.45.0, < 2.45.4affectedUnavailableUnavailableUnavailableNone listed
>= 2.46.0, < 2.46.4affectedUnavailableUnavailableUnavailableNone listed
>= 2.47.0, < 2.47.3affectedUnavailableUnavailableUnavailableNone listed
>= 2.48.0, < 2.48.2affectedUnavailableUnavailableUnavailableNone listed
>= 2.49.0, < 2.49.1affectedUnavailableUnavailableUnavailableNone listed
>= 2.50.0, < 2.50.1affectedUnavailableUnavailableUnavailableNone listed