Skip to main content

CVE-2025-27614: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in j6t gitk

High
VulnerabilityCVE-2025-27614cvecve-2025-27614cwe-78
Published: Thu Jul 10 2025 (07/10/2025, 15:02:25 UTC)
Source: CVE Database V5
Vendor/Project: j6t
Product: gitk

Description

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.

AI-Powered Analysis

AILast updated: 07/10/2025, 15:31:52 UTC

Technical Analysis

CVE-2025-27614 is a high-severity OS command injection vulnerability affecting the j6t gitk tool, a Tcl/Tk based Git history browser. Introduced starting with gitk version 2.41.0, this vulnerability allows an attacker to craft a malicious Git repository such that when a user who has cloned this repository invokes the command 'gitk filename' with a specially structured filename, arbitrary scripts (e.g., Bourne shell, Perl, Python) supplied by the attacker can be executed on the victim's system. The execution occurs with the privileges of the user running gitk, potentially leading to full compromise of the user's environment. The root cause is improper neutralization of special elements used in OS commands (CWE-78), enabling injection of arbitrary commands. The vulnerability requires user interaction in the form of running 'gitk filename' on a maliciously crafted repository, which can be facilitated by social engineering. The flaw affects multiple gitk versions from 2.41.0 up to but not including patched versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1. The CVSS 3.1 base score is 8.6 (high), reflecting local attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild, but the vulnerability is critical due to the ability to execute arbitrary code with user privileges. This vulnerability highlights the risk of executing commands based on untrusted input without proper sanitization in developer tools like gitk.

Potential Impact

For European organizations, the impact of CVE-2025-27614 can be significant, especially for software development teams and DevOps environments that rely on gitk for Git repository visualization and history browsing. Successful exploitation can lead to arbitrary code execution on developer workstations, potentially allowing attackers to steal sensitive source code, credentials, or inject malicious code into development pipelines. This can compromise intellectual property, disrupt software development workflows, and lead to supply chain risks if compromised code is propagated. Additionally, since gitk runs with user privileges, attackers can escalate their foothold within the affected environment, potentially moving laterally or exfiltrating data. The social engineering aspect increases risk as attackers may trick users into opening malicious repositories or files. Organizations with distributed development teams or remote workers who clone external repositories are particularly vulnerable. The vulnerability could also be leveraged in targeted attacks against European critical infrastructure or technology companies that use gitk extensively.

Mitigation Recommendations

1. Immediate upgrade to patched gitk versions: Organizations should update gitk to versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, or 2.50.1 or later to eliminate the vulnerability. 2. Implement strict repository source controls: Restrict cloning and usage of Git repositories from untrusted or unknown sources to reduce exposure to malicious repositories. 3. User training and awareness: Educate developers and users about the risks of opening repositories or files from untrusted sources and the importance of verifying repository integrity. 4. Use alternative Git history tools: Where feasible, use alternative Git visualization tools that are not affected by this vulnerability until patches are applied. 5. Monitor for suspicious activity: Employ endpoint detection and response (EDR) solutions to detect anomalous script execution or command injection attempts on developer machines. 6. Apply principle of least privilege: Run gitk and related tools with minimal user privileges and avoid running as administrator or root to limit impact if exploited. 7. Network segmentation: Isolate developer workstations from critical production systems to prevent lateral movement in case of compromise.

Need more detailed analysis?Get Pro

Technical Details

Data Version
5.1
Assigner Short Name
GitHub_M
Date Reserved
2025-03-03T15:10:34.080Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 686fd939a83201eaaca86b08

Added to database: 7/10/2025, 3:16:09 PM

Last enriched: 7/10/2025, 3:31:52 PM

Last updated: 7/11/2025, 1:46:22 AM

Views: 6

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats