Impact

When gitk is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code.

Patches

• 3650ca5

Workarounds

Avoid using gitk (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

References

• Tcl's exec function documentation
• Related advisory for Git GUI