CVE-2025-46334

published 2025-07-10

CVE-2025-46334: Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter…

Priority P3 43 high 8.6 CVSS 3.1

AV L AC L PR N UI R S C C H I H A H

Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes the current directory. The mentioned programs are invoked when the user selects Git Bash or Browse Files from the menu. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

Affected

20 ranges

Vendor	Product	Version range	Fixed in
debian	git	—	—
git	git	>= 0 < 2.43.7-r0	2.43.7-r0
git	git	>= 0 < 2.45.4-r0	2.45.4-r0
git	git	>= 0 < 2.47.3-r0	2.47.3-r0
git	git	>= 0 < 2.49.1-r0	2.49.1-r0
git	git	>= 0 < 2.50.1-r0	2.50.1-r0
j6t	git-gui	< 2.43.7	2.43.7
j6t	git-gui	—	—
j6t	git-gui	—	—
j6t	git-gui	—	—
j6t	git-gui	—	—
j6t	git-gui	—	—
j6t	git-gui	—	—
j6t	git-gui	—	—
msrc	microsoft_visual_studio_2017_version_15.9	—	—
msrc	microsoft_visual_studio_2019_version_16.11	—	—
msrc	microsoft_visual_studio_2022_version_17.10	—	—
msrc	microsoft_visual_studio_2022_version_17.12	—	—
msrc	microsoft_visual_studio_2022_version_17.14	—	—
msrc	microsoft_visual_studio_2022_version_17.8	—	—

CVSS provenance

nvd v3.1 8.6 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

osv 8.6 HIGH

vendor_debian 8.6 LOW

vendor_msrc 8.6 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78