Skip to content
OpenAdvisories
High · 8.6 CVE-2023-23618 EUVD-2023-27713

gitk can inadvertently call executables in the worktree

Published Feb 14, 2023 · Updated Mar 10, 2025 · Assigned by GitHub_M

Description

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

Affected products

VendorProductAffectedFixed
git-for-windows git < 2.39.2 —

Advisories 1

References