Log in Start free

Vulnerability · Published Jul 10, 2025 · Assigned by GitHub_M

CVE-2025-27613Gitk can create and truncate files in the user's home directory

Low 3.6

In plain English

A low-severity OS command injection in gitk from j6t. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.6Low
Exploit odds (30 days)0.6%top 51.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8git2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10git-all2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8git-all2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-all2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:8git-core2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-core2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10git-core-doc2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8git-core-doc2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-core-doc2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:8git-credential-libsecret2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-credential-libsecret2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:8git-daemon2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-daemon2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10git-email2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8git-email2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-email2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10git-gui2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8git-gui2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-gui2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10git-instaweb2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8git-instaweb2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-instaweb2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10git-subtree2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8git-subtree2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-subtree2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10git-svn2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8git-svn2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9git-svn2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10gitk2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8gitk2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9gitk2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10gitweb2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8gitweb2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9gitweb2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10perl-Git2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8perl-Git2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9perl-Git2.47.3-1.el9_6ALSA-2025:11462
AlmaLinux:10perl-Git-SVN2.47.3-1.el10_0ALSA-2025:11533
AlmaLinux:8perl-Git-SVN2.43.7-1.el8_10ALSA-2025:11534
AlmaLinux:9perl-Git-SVN2.47.3-1.el9_6ALSA-2025:11462
Alpine:v3.20git2.45.4-r0ALPINE-CVE-2025-27613
Alpine:v3.21git2.47.3-r0ALPINE-CVE-2025-27613
Alpine:v3.22git2.49.1-r0ALPINE-CVE-2025-27613
Alpine:v3.23git2.50.1-r0ALPINE-CVE-2025-27613
Alpine:v3.24git2.50.1-r0ALPINE-CVE-2025-27613
Debian:12git1:2.39.5-0+deb12u3DEBIAN-CVE-2025-27613
Debian:13git1:2.47.3-0+deb13u1DEBIAN-CVE-2025-27613
Debian:14git1:2.50.1-0.1DEBIAN-CVE-2025-27613
Rocky Linux:8git0:2.43.7-1.el8_10RLSA-2025:11534
Rocky Linux:9git0:2.47.3-1.el9_6RLSA-2025:11462
Ubuntu:22.04:LTSgit1:2.34.1-1ubuntu1.13USN-7626-1
Ubuntu:22.04:LTSgit1:2.34.1-1ubuntu1.15UBUNTU-CVE-2025-27613
Ubuntu:24.04:LTSgit1:2.43.0-1ubuntu7.3UBUNTU-CVE-2025-27613
Ubuntu:24.04:LTSgit1:2.43.0-1ubuntu7.3USN-7626-1

Affected products (as reported)

VendorProductVersions
j6t gitk >= 1.7.0, < 2.43.7>= 2.44.0, < 2.44.4>= 2.45.0, < 2.45.4>= 2.46.0, < 2.46.4>= 2.47.0, < 2.47.3>= 2.48.0, < 2.48.2>= 2.49.0, < 2.49.1>= 2.50.0, < 2.50.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

References