Threats affecting pkg:brew/git-gui

Git GUI contains a vulnerability that allows an attacker to cause the application to create or overwrite files for which the user has write permission. This occurs when a user clones a malicious repository and is tricked into editing a file in a specially crafted directory. The issue is fixed in Git GUI versions 2.50.1 and later.

Gitk, a Tcl/Tk based Git history browser, contains a vulnerability starting from version 2.41.0 that allows an attacker to craft a Git repository to trick a user into executing arbitrary scripts with the user's privileges by invoking 'gitk filename' with a specially structured filename. This vulnerability is fixed in version 2.50.1.

CVE-2025-27613 is a vulnerability in Gitk, a Tcl/Tk based Git history browser included with git-gui. Starting with version 1.7.0, if a user clones an untrusted repository and runs Gitk without additional arguments, files in the user's home directory for which the user has write permission can be created or truncated. This occurs if the 'Support per-file encoding' option was previously enabled in Gitk's Preferences, or if the 'Show origin of this line' feature is used, regardless of that setting. The vulnerability is fixed in versions 2.50.1 and later.