gitk can inadvertently call executables in the worktree

CVE-2023-23618

What is CVE-2023-23618?

In Git for Windows versions prior to 2.39.2, the 'gitk' tool is susceptible to a vulnerability where it may inadvertently execute binaries from the current working directory. This occurrence can be exploited through social engineering techniques, allowing an attacker to trick users into executing harmful code. Users are advised to avoid using 'gitk' or the Visualize History option in Git GUI for untrusted repositories. An available patch in version 2.39.2 addresses this issue.

References