Vulnerability · Published Jul 10, 2025 · Assigned by GitHub_M
CVE-2025-27614Gitk allows arbitrary command execution
High 8.6
In plain English
A high-severity OS command injection in gitk from j6t. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | git | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-all | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-all | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-all | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:8 | git-core | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-core | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-core-doc | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-core-doc | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-core-doc | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:8 | git-credential-libsecret | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-credential-libsecret | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:8 | git-daemon | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-daemon | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-email | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-email | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-email | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-gui | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-gui | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-gui | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-instaweb | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-instaweb | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-instaweb | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-subtree | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-subtree | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-subtree | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | git-svn | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | git-svn | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | git-svn | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | gitk | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | gitk | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | gitk | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | gitweb | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | gitweb | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | gitweb | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | perl-Git | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | perl-Git | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | perl-Git | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux:10 | perl-Git-SVN | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux:8 | perl-Git-SVN | 2.43.7-1.el8_10 | ALSA-2025:11534 |
| AlmaLinux:9 | perl-Git-SVN | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| Alpine:v3.20 | git | 2.45.4-r0 | ALPINE-CVE-2025-27614 |
| Alpine:v3.21 | git | 2.47.3-r0 | ALPINE-CVE-2025-27614 |
| Alpine:v3.22 | git | 2.49.1-r0 | ALPINE-CVE-2025-27614 |
| Alpine:v3.23 | git | 2.50.1-r0 | ALPINE-CVE-2025-27614 |
| Alpine:v3.24 | git | 2.50.1-r0 | ALPINE-CVE-2025-27614 |
| Debian:13 | git | 1:2.47.3-0+deb13u1 | DEBIAN-CVE-2025-27614 |
| Debian:14 | git | 1:2.50.1-0.1 | DEBIAN-CVE-2025-27614 |
| Rocky Linux:8 | git | 0:2.43.7-1.el8_10 | RLSA-2025:11534 |
| Rocky Linux:9 | git | 0:2.47.3-1.el9_6 | RLSA-2025:11462 |
| Ubuntu:22.04:LTS | git | 1:2.34.1-1ubuntu1.13 | USN-7626-1 |
| Ubuntu:24.04:LTS | git | 1:2.43.0-1ubuntu7.3 | USN-7626-1 |
| Ubuntu:24.04:LTS | git | 1:2.43.0-1ubuntu7.3 | UBUNTU-CVE-2025-27614 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H