Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes the current directory. The mentioned programs are invoked when the user selects Git Bash or Browse Files from the menu. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

An update of the git package has been released.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities.

  - Vulnerability in Gitk where when a user clones an untrusted repository and runs Gitk without additional     command arguments, any writable file can be created and truncated. The option 'Support per-file encoding'     must have been enabled. (CVE-2025-27613)

  - Vulnerability in Gitk where a Git repository can be crafted in such a way that a user who has cloned the     repository can be tricked into running any script supplied by the attacker by invoking gitk filename,     where filename has a particular structure. (CVE-2025-27614)

  - Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized     attacker to elevate privileges over a network. (CVE-2025-49739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.46.4 / 2.50.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-190-01 advisory.

    New git packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the git security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202507-09 (Git: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Git. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253678	Photon OS 4.0: Git PHSA-2025-4.0-0855	Nessus	PhotonOS Local Security Checks	high
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	critical
241959	Security Updates for Microsoft Visual Studio Products (July 2025)	Nessus	Windows : Microsoft Bulletins	high
241672	Slackware Linux 15.0 / current git Multiple Vulnerabilities (SSA:2025-190-01)	Nessus	Slackware Local Security Checks	high
241591	GLSA-202507-09 : Git: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2025-46334

high

Tenable Plugins

high

critical

high

high

high