Description
Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| j6t | gitk | >= 2.41.0, < 2.43.7, >= 2.44.0, < 2.44.4, >= 2.45.0, < 2.45.4, >= 2.46.0, < 2.46.4, >= 2.47.0, < 2.47.3, >= 2.48.0, < 2.48.2, >= 2.49.0, < 2.49.1, >= 2.50.0, < 2.50.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | git | 1:2.50.1-0.1 | — |
| Debian 13 | git | 1:2.47.3-0+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | git | 1:2.43.0-1ubuntu7.3 | USN-7626-1 |
| Ubuntu 22.04 LTS | git | 1:2.34.1-1ubuntu1.13 | USN-7626-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | git | 1:2.25.1-1ubuntu3.14+esm1 | USN-7626-1 |
| Ubuntu Pro 18.04 LTS | git | 1:2.17.1-1ubuntu0.18+esm2 | USN-7626-1 |
| Ubuntu Pro 16.04 LTS | git | 1:2.7.4-0ubuntu1.10+esm9 | USN-7626-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | git +14 | 2.47.3-1.el10_0 | RHSA-2025:11533 |
| RHEL 9 | git +14 | 2.47.3-1.el9_6 | RHSA-2025:11462 |
| RHEL 8 | git +14 | 2.43.7-1.el8_10 | RHSA-2025:11534 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gitk +10 | 2.47.3-1.el10_0 | ALSA-2025:11533 |
| AlmaLinux 9 | git +14 | 2.47.3-1.el9_6 | ALSA-2025:11462 |
| AlmaLinux 8 | git +14 | 2.43.7-1.el8_10 | ALSA-2025:11534 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | git | 2.47.3-1.el9_6 | RLSA-2025:11462 |
| Rocky Linux 8 | git | 2.43.7-1.el8_10 | RLSA-2025:11534 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | git | 2.51.0-150600.3.12.1 | SUSE-SU-2025:03012-1 |
| SLES 15 SP7 | git-lfs | 3.7.0-150600.13.3.1 | SUSE-SU-2025:03012-1 |
| SLES 15 SP7 | obs-scm-bridge | 0.7.4-150600.14.4.1 | SUSE-SU-2025:03012-1 |
| SLES 15 SP6 | git | 2.51.0-150600.3.12.1 | SUSE-SU-2025:03012-1 |
| SLES 15 SP6 | git-lfs | 3.7.0-150600.13.3.1 | SUSE-SU-2025:03012-1 |
| SLES 15 SP6 | obs-scm-bridge | 0.7.4-150600.14.4.1 | SUSE-SU-2025:03012-1 |
| SLES 15 SP5 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SLES 15 SP4 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SLES 15 SP3 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 3 | python-PyYAML | 6.0.2-150600.10.3.1 | SUSE-SU-2025:03012-1 |
| SLES for SAP 15 SP5 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SLES for SAP 15 SP4 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SLES for SAP 15 SP3 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SLE Micro 6.1 | git | 2.51.0-slfo.1.1_1.1 | SUSE-SU-2025:20855-1 |
| SLE Micro 6.0 | git | 2.51.0-1.1 | SUSE-SU-2025:20721-1 |
| SLE Micro 5.5 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SLE HPC 15 SP5 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SLE HPC 15 SP4 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SLE HPC 15 SP3 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SUSE Manager Server LTS 4.3 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SUSE Manager Proxy LTS 4.3 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
| SUSE Enterprise Storage 7.1 | git | 2.43.7-150300.10.51.1 | SUSE-SU-2025:03037-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git | 2.50.1-1.1 | openSUSE-SU-2025:15337-1 |
| openSUSE Leap 15.6 | git | 2.51.0-150600.3.12.1 | SUSE-SU-2025:03012-1 |
| openSUSE Leap 15.6 | git-lfs | 3.7.0-150600.13.3.1 | SUSE-SU-2025:03012-1 |
| openSUSE Leap 15.6 | obs-scm-bridge | 0.7.4-150600.14.4.1 | SUSE-SU-2025:03012-1 |
| openSUSE Leap 15.6 | python-PyYAML | 6.0.2-150600.10.3.1 | SUSE-SU-2025:03012-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | git | 2.50.1-r0 | — |
| Alpine v3.23 | git | 2.50.1-r0 | — |
| Alpine v3.22 | git | 2.49.1-r0 | — |
| Alpine v3.21 | git | 2.47.3-r0 | — |
| Alpine v3.20 | git | 2.45.4-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | git | 2.43.7-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | git +16 | 2.50.1-1.amzn2023.0.1 | ALAS2023-2025-1108 |
| Amazon Linux 2 | git +16 | 2.47.3-1.amzn2.0.1 | ALAS2-2025-2941 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | git | 2.45.4-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | git +14 | 2.47.3-1.el10_0 | ELSA-2025-11533 |
| Oracle Linux 9 | git +14 | 2.47.3-1.el9_6 | ELSA-2025-11462 |
| Oracle Linux 8 | git +14 | 2.43.7-1.el8_10 | ELSA-2025-11534 |
Advisories 22
- ALSA-2025:11462 Important: git security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:11533 Important: git security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:11534 Important: git security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:11534 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:11462 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:11533 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- USN-7626-1 git vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2025:20721-1 Security update for git SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20855-1 Security update for git SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03037-1 Security update for git SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1905 IBM QRadar SIEM Komponente: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 4, 2026
- SUSE-SU-2025:03012-1 security update for git, git-lfs, obs-scm-bridge, python-PyYAML SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15337-1 git-2.50.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1485 Microsoft Developer Tools und git: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 26, 2025
- RLSA-2025:11462 Important: git security update Rocky Linux Security Advisories · Oct 7, 2025
- ALAS2023-2025-1108 Important: git security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 8, 2025
- ALAS2-2025-2941 Important: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 30, 2025
- RLSA-2025:11534 Important: git security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-11533 Important: git security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 22, 2025
- ELSA-2025-11534 Important: git security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 22, 2025
- ELSA-2025-11462 Important: git security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 21, 2025
- NCSC-2025-0217 Kwetsbaarheden verholpen in Microsoft Visual Studio NCSC-NL (Netherlands) · Jul 8, 2025