Avih
·
Published
2025-01-01
·
Updated
2025-08-12
·
CVE-2025-27614
8.6
High
| Base vector | Vector | AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
**Name of the Vulnerable Software and Affected Versions:**
Gitk versions 2.41.0 through 2.43.6
Git versions 2.50.1-alt1
**Description:**
Gitk, a Tcl/Tk based Git history browser, contains a flaw where a crafted Git repository can be used to trick a user into executing arbitrary scripts with their user privileges via the `gitk filename` command. This is possible due to a lack of sanitization of special elements. Exploitation requires social engineering.
**Recommendations:**
Update Gitk to version 2.43.7 or later.
Update Git to version 2.50.1-alt1.
Fix
RCE
OS Command Injection