Untrusted search path in Git - CVE-2025-46334

Vulnerability identifier: #VU112644

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-46334

CWE-ID: CWE-426

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of an untrusted search path in Git GUI on Windows. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. On Windows, path lookup can find such executables in the worktree. These programs are invoked when the user selects "Git Bash" or "Browse Files" from the menu.

Note, the vulnerability affects Windows installations only. 

Git
Visual Studio
openEuler
perl-Git
git-debugsource
git-debuginfo
git-daemon
git
git-email
git-gui
git-help
git-svn
git-web
gitk
perl-Git-SVN
git-core

Install updates from vendor's website.

Git - addressed in versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1
Visual Studio - addressed in versions 15.9.75 15.9.75, 16.11.49 16.11.49, 17.8.23 17.8.23, 17.10.17 17.10.17, 17.12.10 17.12.10
perl-Git - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-debugsource - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-debuginfo - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-daemon - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-email - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-gui - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-help - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-svn - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-web - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
gitk - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
perl-Git-SVN - addressed in versions 2.27.0-25, 2.33.0-19, 2.43.0-9
git-core - addressed in versions 2.33.0-19, 2.43.0-9

• https://www.openwall.com/lists/oss-security/2025/07/08/4
• https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/

• Multiple vulnerabilities in Git
• Microsoft Visual Studio update for Git
• openEuler 22.03 LTS SP3 update for git
• openEuler 20.03 LTS SP4 update for git
• openEuler 24.03 LTS SP2 update for git
• openEuler 24.03 LTS SP1 update for git
• openEuler 24.03 LTS update for git
• openEuler 22.03 LTS SP4 update for git