CVE-2025-27613: j6t gitk OS Command Injection

CVSS: 3.6v3.1LowDeferred

AliasesALPINE-CVE-2025-27613UBUNTU-CVE-2025-27613DEBIAN-CVE-2025-27613

Published 10-07-2025Last modified 04-11-2025

Vulnerability summary

CVE-2025-27613 is a low (CVSS 3.6) OS Command Injection vulnerability in j6t gitk. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.7% of scored vulnerabilities.

Overall risk

15/100

0100

Low · default modelHow is this calculated?

CVSS score

3.6/10

010

Low · v3.1 (CVE.org)

EPSS score

0.60%

0%100%

Low · +0.07 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 9

DLA-4323-1 OPENSUSE-SU-2025:15337-1 RHSA-2025:11462 RHSA-2025:11533 RHSA-2025:11534 SUSE-SU-2025:03012-1+7 more

Timeline

10-07-2025
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

CVSS metrics

5 scores · 5 sources · 1 version

v3.13.6

EPSS trend

Probability

0.60%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

+0.07 pp

From 0.53% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Alpine1 product

git< 2.43.7-r0 | < 2.45.4-r0 | < 2.47.3-r0 | < 2.49.1-r0 | < 2.50.1-r0

Debian1 product

git< 1:2.39.5-0+deb12u3 | < 1:2.47.3-0+deb13u1 | < 1:2.50.1-0.1

J6t1 product

gitk≥ 1.7.0, < 2.43.7 | ≥ 2.44.0, < 2.44.4 | ≥ 2.45.0, < 2.45.4 | ≥ 2.46.0, < 2.46.4 | ≥ 2.47.0, < 2.47.3 | ≥ 2.48.0, < 2.48.2 | ≥ 2.49.0, < 2.49.1 | ≥ 2.50.0, < 2.50.1

Ubuntu1 product