diff options
| author | Johannes Sixt <j6t@kdbg.org> | 2025-05-14 18:27:05 +0200 |
|---|---|---|
| committer | Taylor Blau <me@ttaylorr.com> | 2025-05-23 17:04:30 -0400 |
| commit | 4e7e3b792e6973e09de6ddc191b86bbc245c53dd (patch) | |
| tree | b2ba96a1873441245fda2cc9df47af7aef9f24b7 /git-gui/lib/commit.tcl | |
| parent | 664d4fa692cb8637a7c9297c94abf0de8593e585 (diff) | |
| parent | 8e3070aa5e331be45d4d03e3be41f84494fce129 (diff) | |
Merge branch 'ah/fix-open-with-stdin'
This addresses CVE-2025-27614, Arbitrary command execution with Gitk:
A Git repository can be crafted in such a way that with some social
engineering a user who has cloned the repository can be tricked into
running any script (e.g., Bourne shell, Perl, Python, ...) supplied by
the attacker by invoking `gitk filename`, where `filename` has a
particular structure. The script is run with the privileges of the user.
Signed-off-by: Johannes Sixt <j6t@kdbg.org>
Diffstat (limited to 'git-gui/lib/commit.tcl')
0 files changed, 0 insertions, 0 deletions