CVE-2025-27614

GitHub: CVE-2025-27614 Gitk Arbitrary Code Execution Vulnerability

Published
July 8, 2025
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2025-27614 →

📋 Description

CVE-2025-27614 is regarding a vulnerability in Gitk where a Git repository can be crafted in such a way that a user who has cloned the repository can be tricked into running any script supplied by the attacker by invoking gitk filename, where filename has a particular structure. GitHub created this CVE on their behalf. The documented Visual Studio updates incorporate updates in GitK which address this vulnerability. Please see CVE-2025-27614 for more information.

🎯 Affected products6

  • Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
  • Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  • Microsoft Visual Studio 2022 version 17.10
  • Microsoft Visual Studio 2022 version 17.12
  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2022 version 17.8

✅ Remediation

KBRelease Notes (Security Update) — fixed build 17.8.23 KBRelease Notes (Security Update) — fixed build 17.10.17 KBRelease Notes (Security Update) — fixed build 17.12.10 KBRelease Notes (Security Update) — fixed build 17.14.8 KBRelease Notes (Security Update) — fixed build 16.11.49 KBRelease Notes (Security Update) — fixed build 15.9.75

🔗 References (10)