CVE-2025-27613

GitHub: CVE-2025-27613 Gitk Arguments Vulnerability

Published
July 8, 2025
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2025-27613 →

📋 Description

CVE-2025-27613 is regarding a vulnerability in Gitk where when a user clones an untrusted repository and runs Gitk without additional command arguments, any writable file can be created and truncated. The option "Support per-file encoding" must have been enabled. The operation "Show origin of this line" is affected as well, regardless of the option being enabled or not. GitHub created this CVE on their behalf. The documented Visual Studio updates incorporate updates in GitK which address this vulnerability. Please see CVE-2025-27613 for more information.

🎯 Affected products6

  • Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
  • Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  • Microsoft Visual Studio 2022 version 17.10
  • Microsoft Visual Studio 2022 version 17.12
  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2022 version 17.8

✅ Remediation

KBRelease Notes (Security Update) — fixed build 17.8.23 KBRelease Notes (Security Update) — fixed build 17.10.17 KBRelease Notes (Security Update) — fixed build 17.12.10 KBRelease Notes (Security Update) — fixed build 17.14.8 KBRelease Notes (Security Update) — fixed build 16.11.49 KBRelease Notes (Security Update) — fixed build 15.9.75

🔗 References (10)