Description
Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes the current directory. The mentioned programs are invoked when the user selects Git Bash or Browse Files from the menu. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| j6t | git-gui | < 2.43.7, >= 2.44.0, < 2.44.4, >= 2.45.0, < 2.45.4, >= 2.46.0, < 2.46.4, >= 2.47.0, < 2.47.3, >= 2.48.0, < 2.48.2, >= 2.49.0, < 2.49.1, >= 2.50.0, < 2.50.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | git | 2.51.0-1.1 | SUSE-SU-2025:20721-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git | 2.50.1-1.1 | openSUSE-SU-2025:15337-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | git | 2.50.1-r0 | — |
| Alpine v3.23 | git | 2.50.1-r0 | — |
| Alpine v3.22 | git | 2.49.1-r0 | — |
| Alpine v3.21 | git | 2.47.3-r0 | — |
| Alpine v3.20 | git | 2.45.4-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | git | 2.43.7-r0 | — |
Advisories 4
- SUSE-SU-2025:20721-1 Security update for git SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15337-1 git-2.50.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1485 Microsoft Developer Tools und git: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 26, 2025
- NCSC-2025-0217 Kwetsbaarheden verholpen in Microsoft Visual Studio NCSC-NL (Netherlands) · Jul 8, 2025