CVE-2023-23618

    Dashboard / Vulnerabilities / CVE-2023-23618

    CVE-2023-23618

    Published: 14 Feb 2023Last Modified: 21 Oct 2026

    Summary: gitk can inadvertently call executables in the worktree

    Details: Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

    References: https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1, https://wiki.tcl-lang.org/page/exec, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23618.json, https://github.com/git-for-windows/git/security/advisories/GHSA-wxwv-49qw-35pm, https://nvd.nist.gov/vuln/detail/CVE-2023-23618, https://github.com/git-for-windows/git/commit/49a8ec9dac3cec6602f05fed1b3f80a549c8c05c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a82fa99b36ddfd643e61ed45e52abe314687df67

    Affected versions

    v2.30.0-rc2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High