This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Git fixes 7 vulnerabilities in Git, Git GUI and Gitk

Git version 2.50.1 fixes 7 vulnerabilities in the Git tool and in its graphical interfaces Git GUI and Gitk [1]. The most severe of them are listed below.

Git - arbitrary code execution (CVE-2025-48384)
CVSS 8.0 (High)

An authenticated remote attacker is, due to unhandled treatment of trailing CR (carriage return) characters when writing configuration values via a submodule post-checkout hook, allowed to execute arbitrary code [1][2].

The vulnerability is present in product:

  • Git; <2.50.1

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 8. 7. 2025.

Git - arbitrary code execution (CVE-2025-48385)
CVSS 8.6 (High)

An unauthenticated remote attacker is, due to insufficient validation of bundles by the Git client, allowed to perform protocol injection and make the client write a bundle to an arbitrary location, which may lead to arbitrary code execution [1][3].

The vulnerability is present in product:

  • Git; <2.50.1

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2025-48385 at cve.org, NVD
  • CWE-73: External Control of File Name or Path at cwe.mitre.org
  • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2025.

Gitk - arbitrary code execution (CVE-2025-27614)
CVSS 8.6 (High)

An unauthenticated local attacker is, due to insufficient file name validation when the gitk command is run, allowed to plant a specially crafted file on the user, the opening of which may lead to execution of an attacker-supplied script and subsequent execution of arbitrary code [1][4].

The vulnerability is present in product:

  • Git; <2.50.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

  • CVE-2025-27614 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2025.

Git GUI - arbitrary code execution (CVE-2025-46334)
CVSS 8.6 (High)

An unauthenticated local attacker is allowed to exploit faulty path handling in Git GUI for Windows to plant malicious binaries such as sh.exe or astextplain, which are executed automatically when Git Bash is opened or files are viewed, which may lead to arbitrary code execution [1][5].

The vulnerability is present in product:

  • Git; <2.50.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

  • CVE-2025-46334 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 22. 7. 2025.

CESNET, z.s.p.o. Logo