What’s Vulnerable › Vulnerabilities

CVE-2023-23618: gitk can inadvertently call executables in the worktree

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-14 · updated 2026-06-17
• Weakness: CWE-426

Description

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

Affected products

• git-for-windows git: before 2.39.2 — fixed in 2.39.2

How to fix

Upgrade to a fixed version: git-for-windows git 2.39.2. Check the vendor advisory for mitigations.

References

• https://github.com/git-for-windows/git/commit/49a8ec9dac3cec6602f05fed1b3f80a549c8c05c
• https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1
• https://github.com/git-for-windows/git/security/advisories/GHSA-wxwv-49qw-35pm
• https://wiki.tcl-lang.org/page/exec
• https://github.com/git-for-windows/git/commit/49a8ec9dac3cec6602f05fed1b3f80a549c8c05c
• https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1
• https://github.com/git-for-windows/git/security/advisories/GHSA-wxwv-49qw-35pm
• https://wiki.tcl-lang.org/page/exec

Get alerted when CVE-2023-23618 or the next vulnerability affects your stack