CVE-2023-23618 - CVE House

Back to Database

Status published High CVE-2023-23618

gitk can inadvertently call executables in the worktree

8.6 CVSS

Vulnerability Description

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23618

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from git-for-windows

View All →

Git for Windows leaks NTLM hash when cloning from an attacker-controlled server

Git CMD erroneously executes `doskey.exe` in the current directory, if it exists

Git for Windows's config file of `connect.exe` is susceptible to malicious placing

Git looks for localized messages in the wrong place

Git for Windows' installer is susceptible to DLL side loading attacks

Affected Vendor

git-for-windows

View all reports →

Affected Software

git

Vulnerable Versions:

< 2.39.2

Timeline

Official Publish: February 14th, 2023

Last Modified: March 10th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

Privilege Escalation

T1036 Masquerading

Defense Evasion

T1543 Create or Modify System Process

T1059 Command and Scripting Interpreter

T1569 System Services