Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-46334

Good to know:

icon

Date: July 10, 2025

Git GUI (Windows only): A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. On Windows, path lookup can find such executables in the worktree. These programs are invoked when the user selects "Git Bash" or "Browse Files" from the menu.

Severity Score

Related Resources (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-46334
https://seclists.org/oss-sec/2025/q3/13
https://github.com/j6t/git-gui/security/advisories/GHSA-7px4-9hg2-fvhx
https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a1ccd2512072cf52835050f4c97a4fba9f0ec8f9
https://www.mend.io/vulnerability-database/CVE-2025-46334

Severity Score

Weakness Type (CWE)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78

Uncontrolled Search Path Element

CWE-427

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/git/git.git - v2.50.1;https://github.com/git/git.git - v2.49.1;https://github.com/git/git.git - v2.48.2;https://github.com/git/git.git - v2.47.3;https://github.com/git/git.git - v2.46.4;https://github.com/git/git.git - v2.45.4;https://github.com/git/git.git - v2.44.4;https://github.com/git/git.git - v2.43.7

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us