Skip to content
Fencer Vulns
high 8.6

CVE-2025-27614 json

Gitk allows arbitrary command execution

published 2025-07-10 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-21004

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.

Patch / fix

  • git Debian 13 1:2.47.3-0+deb13u1
  • git Debian 14 1:2.50.1-0.1

debian advisories DEBIAN-CVE-2025-27614

  • git Ubuntu 24.04 LTS 1:2.43.0-1ubuntu7.3

ubuntu advisories UBUNTU-CVE-2025-27614

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • git RHEL 8 2.43.7-1.el8_10
  • gitk RHEL 8 2.43.7-1.el8_10
  • gitweb RHEL 8 2.43.7-1.el8_10
  • git-all RHEL 8 2.43.7-1.el8_10
  • git-gui RHEL 8 2.43.7-1.el8_10
  • git-svn RHEL 8 2.43.7-1.el8_10
  • git-core RHEL 8 2.43.7-1.el8_10
  • perl-Git RHEL 8 2.43.7-1.el8_10

red hat advisories RHSA-2025:11534RHSA-2025:11533RHSA-2025:11462

  • git Linux Micro 6.1 2.51.0-slfo.1.1_1.1
  • git Linux Micro 6.0 2.51.0-1.1
  • git SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 2.43.7-150300.10.51.1
  • python-PyYAML SLE Module for Python 3 15 SP7, SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 6.0.2-150600.10.3.1
  • git SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6, SLE Module for Basesystem 15 SP7 +2 more 2.51.0-150600.3.12.1
  • git-lfs SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 3.7.0-150600.13.3.1
  • obs-scm-bridge SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 0.7.4-150600.14.4.1

suse advisories SUSE-SU-2025:20855-1SUSE-SU-2025:20721-1SUSE-SU-2025:03037-1SUSE-SU-2025:03012-1

  • git openSUSE Tumbleweed 2.50.1-1.1

opensuse advisories openSUSE-SU-2025:15337-1

  • gitk AlmaLinux 10 2.47.3-1.el10_0
  • gitweb AlmaLinux 10 2.47.3-1.el10_0
  • git-all AlmaLinux 10 2.47.3-1.el10_0
  • git-gui AlmaLinux 10 2.47.3-1.el10_0
  • git-svn AlmaLinux 10 2.47.3-1.el10_0
  • perl-Git AlmaLinux 10 2.47.3-1.el10_0
  • git-email AlmaLinux 10 2.47.3-1.el10_0
  • git-subtree AlmaLinux 10 2.47.3-1.el10_0

almalinux advisories ALSA-2025:11533ALSA-2025:11534ALSA-2025:11462

  • git Rocky Linux 9 2.47.3-1.el9_6
  • git Rocky Linux 8 2.43.7-1.el8_10

rocky linux advisories RLSA-2025:11462RLSA-2025:11534

  • git Alpine 3.19 2.43.7-r0
  • git Alpine 3.20 2.45.4-r0
  • git Alpine 3.21 2.47.3-r0
  • git Alpine 3.22 2.49.1-r0
  • git Alpine 3.24, Alpine 3.23 2.50.1-r0

alpine advisories ALPINE-CVE-2025-27614

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • git Azure Linux 3.0 2.45.4-1

azure linux advisories AZL-65079

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-27614 updated cvss 6.3

gitk: git script execution flaw

  • Red Hat Enterprise Linux 6 git, gitk, gitweb, git-all, git-cvs, git-gui, +6 more Red Hat Enterprise Linux 7 git, gitk, git-hg, git-p4, gitweb, git-all, +12 more
    affected: workaround, no fix planned “There's no known mitigation for this issue besides avoid using gitk with untrusted repositories or unstrusted files.”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “There's no known mitigation for this issue besides avoid using gitk with untrusted repositories or unstrusted files.”
  • Red Hat Enterprise Linux AppStream (v. 8) git 2.43.7-1.el8_10, gitk 2.43.7-1.el8_10, gitweb 2.43.7-1.el8_10, git-all 2.43.7-1.el8_10, git-gui 2.43.7-1.el8_10, git-svn 2.43.7-1.el8_10, +8 more
    fixed: vendor fix “There's no known mitigation for this issue besides avoid using gitk with untrusted repositories or unstrusted files.” RHSA-2025:11534
  • Red Hat Enterprise Linux AppStream (v. 9) git 2.47.3-1.el9_6, gitk 2.47.3-1.el9_6, gitweb 2.47.3-1.el9_6, git-all 2.47.3-1.el9_6, git-gui 2.47.3-1.el9_6, git-svn 2.47.3-1.el9_6, +8 more
    fixed: vendor fix “There's no known mitigation for this issue besides avoid using gitk with untrusted repositories or unstrusted files.” RHSA-2025:11462
  • Red Hat Enterprise Linux AppStream (v. 10) git 2.47.3-1.el10_0, gitk 2.47.3-1.el10_0, gitweb 2.47.3-1.el10_0, git-all 2.47.3-1.el10_0, git-gui 2.47.3-1.el10_0, git-svn 2.47.3-1.el10_0, +8 more
    fixed: vendor fix “There's no known mitigation for this issue besides avoid using gitk with untrusted repositories or unstrusted files.” RHSA-2025:11533

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
15 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

  • j6t gitk

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.