CVE-2022-41953

Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources.

• CWE-426

• https://github.com/git-for-windows/git/commit/7360767e8dfc1895a932324079f7d45d7791d39fPatch, Third Party Advisory
• https://github.com/git-for-windows/git/pull/4219Patch, Third Party Advisory
• https://github.com/git-for-windows/git/security/advisories/GHSA-v4px-mx59-w99cPatch, Third Party Advisory
• https://www.tcl.tk/man/tcl8.6/TclCmd/exec.html#M23Third Party Advisory
• https://github.com/git-for-windows/git/commit/7360767e8dfc1895a932324079f7d45d7791d39fPatch, Third Party Advisory
• https://github.com/git-for-windows/git/pull/4219Patch, Third Party Advisory
• https://github.com/git-for-windows/git/security/advisories/GHSA-v4px-mx59-w99cPatch, Third Party Advisory
• https://www.tcl.tk/man/tcl8.6/TclCmd/exec.html#M23Third Party Advisory

Published

Jan 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41948DHIS 2 is an open source information system for data capture…7.2
• CVE-2022-41949DHIS 2 is an open source information system for data capture…4.3
• CVE-2022-4195Insufficient policy enforcement in Safe Browsing in Google C…4.3
• CVE-2022-41950super-xray is the GUI alternative for vulnerability scanning…7.8
• CVE-2022-41951OroPlatform is a PHP Business Application Platform (BAP) des…9.8
• CVE-2022-41952Synapse before 1.52.0 with URL preview functionality enabled…5.3
• CVE-2022-41954MPXJ is an open source library to read and write project pla…3.3
• CVE-2022-41955Autolab is a course management service, initially developed …8.8
• CVE-2022-41956Autolab is a course management service, initially developed …6.5
• CVE-2022-41957Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2022-41958super-xray is a web vulnerability scanning tool. Versions pr…7.8
• CVE-2022-4196The Multi Step Form WordPress plugin before 1.7.8 does not s…4.8