CVE-2023-23618: Git For Windows Project Git For Windows

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

Affected products

• Git For Windows Project Git For Windows: before 2.39.2 (fixed in 2.39.2)

Published 2023-02-14. Last modified 2026-06-17.