CVE-2025-27613

A vulnerability has been identified in the gitk application that could lead to unauthorized file modification or data loss.

This flaw manifests in two primary scenarios:

• Untrusted Repository Cloning: When a user is tricked into cloning an untrusted Git repository and then uses gitk to visualize it without any additional parameters, any writable file on the user's system can be arbitrarily created or truncated. Exploitation via this method also requires the Support per-file encoding option to be explicitly enabled in Gitk's preferences, which is not the default setting.
• 'Show origin of this line' Command: The vulnerability can also be triggered if a user employs the Show origin of this line command within gitk's main window while viewing a malicious repository. This method does not depend on the Support per-file encoding option being enabled.

The primary risk is unauthorized file system modification, which could lead to data integrity issues, data loss, or potentially open avenues for further system compromise.

The Red Hat Product Security team rated this vulnerability as having a Moderate security impact. Exploitation depends on a non-default option being enabled and the user being tricked into cloning the untrusted repository or using the "Show origin of this line" command in the main window.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As a workaround, ensure that the option "Support per-file encoding" in Gitk's Preferences is disabled, and do not use the "Show origin of this line" command, which is affected regardless of that option. In addition, do not use gitk to view repositories from untrusted sources, or stop using gitk entirely.