CVE-2025-27614

What it actually does

A crafted Git repository allows arbitrary script execution via gitk when a user invokes it on a specially structured filename, running the attacker-supplied script with the user's privileges.

Why it matters to the business

Developers or users interacting with malicious repositories risk unauthorized code execution on their systems, potentially leading to credential theft, data exfiltration, or further compromise; urgency remains moderate given the 475-day publication age, lack of KEV listing, and slow EPSS growth despite named threat actor references.

How an attack unfolds

An attacker creates a Git repository containing a filename with a particular structure that embeds or references an arbitrary script (Bourne shell, Perl, Python, etc.); through social engineering the victim is induced to clone the repository and run gitk against that filename, triggering execution of the script under the victim's privileges. The Git Link Following Vulnerability campaign highlights targeted use against developers.

How to fix it

Upgrade Git to one of the fixed versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, or 2.50; for the listed packages apply jitsucom-jitsu, jitsucom-jitsu-console, and jitsucom-jitsu-rotor updates to 2.10.0-r2 on both Chainguard and Wolfi; update j6t/gitk to commit 8e3070aa5e331be45d4d03e3be41f84494fce129.

How to confirm the fix worked

Verify the installed Git version matches a fixed release; attempt to reproduce the issue with a test repository containing a crafted filename and confirm no script execution occurs; review package manifests for the exact fixed versions listed per distribution.

Typical attack path

1. Craft a malicious Git repository embedding a specially structured filename that references an attacker-controlled script
2. Distribute or socially engineer the victim into cloning the repository
3. Trick the victim into invoking gitk on the crafted filename
4. Script executes with the privileges of the invoking user

How to detect it

Search process execution logs and command-line audit trails for gitk invocations referencing unusual or specially named files within cloned repositories; correlate with subsequent execution of scripts (shell, Python, Perl) that were not explicitly invoked by the user; review threat actor references to the Git Link Following Vulnerability for context on targeted developer environments.

• gitk filename
• gitk invocation on repository path containing embedded script reference
• unexpected script execution immediately following gitk process start

What your security team should do

• Immediately upgrade all Git installations to a patched version listed in remediation guidance
• Block or monitor gitk usage in CI/CD or developer environments until patches are applied
• Educate users on risks of invoking gitk directly on untrusted repository contents
• Add gitk and related Tcl/Tk processes to endpoint monitoring rules for anomalous script execution