CVE-2025-27613: Gitk Git History Browser RCE Vulnerability

CVE-2025-27613 Overview

CVE-2025-27613 is a command injection vulnerability (CWE-78) affecting Gitk, a Tcl/Tk based Git history browser. Starting with version 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. This vulnerability requires specific conditions to be exploited: either the "Support per-file encoding" option must be enabled in Gitk's Preferences (disabled by default), or the "Show origin of this line" feature must be used in the main window.

Critical Impact

An attacker controlling a malicious Git repository could craft repository contents that, when viewed with Gitk under specific configurations, cause arbitrary file creation or truncation on the victim's system.

Affected Products

• Gitk versions 1.7.0 through 2.43.6
• Gitk versions 2.44.0 through 2.44.3
• Gitk versions 2.45.0 through 2.45.3
• Gitk versions 2.46.0 through 2.46.3
• Gitk versions 2.47.0 through 2.47.2
• Gitk versions 2.48.0 through 2.48.1
• Gitk versions 2.49.0 and 2.50.0

Discovery Timeline

• 2025-07-08 - Vulnerability disclosed via OpenWall OSS-Security
• 2025-07-10 - CVE CVE-2025-27613 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-27613

Vulnerability Analysis

This vulnerability stems from improper neutralization of special elements used in an OS command (CWE-78). Gitk, when processing repository data under certain configurations, fails to properly sanitize input before passing it to shell commands. The vulnerability manifests through two distinct attack vectors within the Gitk application.

The first vector requires the "Support per-file encoding" preference to be enabled. When this setting is active and a user opens a malicious repository, specially crafted repository content can trigger command injection that results in file creation or truncation. The second vector operates through the "Show origin of this line" feature in the main window, which can be exploited regardless of the encoding preference setting.

The attack requires local access, meaning an attacker must convince a victim to clone and open a malicious repository with Gitk. While the vulnerability has a local attack vector and requires user interaction, the changed scope indicates the impact extends beyond the vulnerable component itself, potentially affecting other system files.

Root Cause

The root cause of CVE-2025-27613 is insufficient input validation in Gitk's handling of repository content when processing file encoding operations and blame line origin lookups. The Tcl/Tk application constructs shell commands using unsanitized data derived from repository contents, allowing specially crafted repository data to inject malicious commands. This classic command injection pattern occurs because user-controlled input (repository content) is concatenated directly into command strings without proper escaping or parameterization.

Attack Vector

The attack requires an adversary to create a malicious Git repository containing specially crafted content designed to exploit Gitk's command handling. When a victim clones this repository and opens it with Gitk, the malicious payload executes under either of these conditions:

1. The victim has previously enabled "Support per-file encoding" in Gitk preferences
2. The victim uses the "Show origin of this line" context menu option

The exploitation results in the creation or truncation of files on the victim's system where the user has write permissions. While this does not directly allow arbitrary code execution, file truncation could be leveraged to disable security controls, corrupt configuration files, or cause denial of service conditions.

For detailed technical analysis of the vulnerability and its exploitation mechanics, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-27613

Indicators of Compromise

• Unexpected file creation or truncation in user-writable directories following Gitk usage
• Newly created empty files in system or user configuration directories
• Modified or corrupted configuration files after interacting with Git repositories via Gitk
• Suspicious Git repositories containing unusual encoding specifications or blame-related metadata

Detection Strategies

• Monitor for unexpected file system modifications occurring during or immediately after Gitk process execution
• Implement file integrity monitoring on critical configuration files and directories
• Review cloned repositories for suspicious content before opening with Gitk
• Audit Gitk preference files for unexpected "Support per-file encoding" enablement

Monitoring Recommendations

• Enable process auditing to track Gitk execution and associated child processes
• Configure file system audit rules to monitor file creation and truncation events in user directories
• Implement endpoint detection rules for suspicious command execution patterns from Gitk processes
• Review Git clone operations and correlate with subsequent Gitk usage patterns

How to Mitigate CVE-2025-27613

Immediate Actions Required

• Update Gitk to a patched version: 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, or 2.50.1
• Disable "Support per-file encoding" in Gitk Preferences if update is not immediately possible
• Avoid using "Show origin of this line" feature until patched
• Exercise caution when cloning and viewing untrusted Git repositories

Patch Information

The vulnerability has been fixed in multiple Gitk versions across different release branches. Users should update to the following patched versions based on their current installation:

For detailed patch changes, refer to the GitHub commit comparisons and the Debian LTS announcement.

Workarounds

• Disable "Support per-file encoding" in Gitk's Edit → Preferences menu
• Avoid using the "Show origin of this line" feature when viewing untrusted repositories
• Use alternative Git history browsers such as git log, tig, or GUI clients until patching is complete
• Clone untrusted repositories in isolated environments or containers before inspection

# Check current Gitk version
gitk --version

# Disable per-file encoding via preferences (if applicable)
# Navigate to Edit -> Preferences in Gitk and uncheck "Support per-file encoding"

# Alternative: Use command-line git log instead of gitk for untrusted repos
git log --oneline --graph --all