With Gitk, the Git history browser, when a user clones an untrusted
repository and runs gitk without additional command arguments,
files for which the user has write permission can be created and
truncated. The option Support per-file encoding must have been enabled
before in Gitk's Preferences. This option is disabled by default. The
same happens when Show origin of this line is used in the main window
(regardless of whether Support per-file encoding is enabled or not).
CVE-2025-46835
When a user clones an untrusted repository and is tricked into editing
a file located in a maliciously named directory in the repository,
then Git GUI can create and overwrite files for which the user has
write permission.
CVE-2025-48384
When reading a config value, Git strips any trailing carriage return
and line feed (CRLF). When writing a config entry, values with a
trailing CR are not quoted, causing the CR to be lost when the config
Get the latest Linux and open source security news straight to your inbox.