CVE-2025-46334

Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes the current directory. The mentioned programs are invoked when the user selects Git Bash or Browse Files from the menu. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

• CWE-78

• https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a1ccd2512072cf52835050f4c97a4fba9f0ec8f9
• https://github.com/j6t/git-gui/security/advisories/GHSA-7px4-9hg2-fvhx
• http://www.openwall.com/lists/oss-security/2025/07/08/4

Published

Jul 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46329libsnowflakeclient is the Snowflake Connector for C/C++. Ver…3.3
• CVE-2025-4633Default credentials were present in the web portal for Airpo…6.5
• CVE-2025-46330libsnowflakeclient is the Snowflake Connector for C/C++. Ver…3.3
• CVE-2025-46331OpenFGA is a high-performance and flexible authorization/per…9.8
• CVE-2025-46332Flags SDK is an open-source feature flags toolkit for Next.j…6.5
• CVE-2025-46333z2d is a pure Zig 2D graphics library. Versions of z2d after…7.3
• CVE-2025-46335Mobile Security Framework (MobSF) is a security research pla…5.4
• CVE-2025-46336Rack::Session is a session management implementation for Rac…4.2
• CVE-2025-46337ADOdb is a PHP database class library that provides abstract…10
• CVE-2025-46338Audiobookshelf is a self-hosted audiobook and podcast server…6.1
• CVE-2025-46339FreshRSS is a self-hosted RSS feed aggregator. Prior to vers…4.3
• CVE-2025-4634The web portal on airpointer 2.4.107-2 was vulnerable local …4.1