Git GUI for Windows is vulnerable to arbitrary OS command injection via malicious repositories, posing a critical risk of full system compromise for users who interact with untrusted content.

This is an OS Command Injection vulnerability (CWE-78) triggered by the insecure design of Tcl on Windows, which includes the current directory in its search path for executables. An attacker can force the execution of malicious versions of programs like sh.exe or textconv filters when a user performs standard operations such as browsing files.

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running the Git GUI application. Given the CVSS score of 8.6, this represents a high-severity threat that could lead to full workstation compromise, unauthorized access to sensitive source code repositories, and potential lateral movement within the corporate network.

Immediate Action: Update Git GUI to the fixed versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, or 2.50.1.

Proactive Monitoring: Monitor endpoint logs for the unexpected execution of sh.exe or other shell utilities initiated by the Git GUI process.

Compensating Controls: Avoid opening untrusted or unknown Git repositories using the Git GUI interface until the software has been updated to a patched version.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention, particularly for development teams frequently interacting with external or third-party repositories. Organizations must prioritize the deployment of the provided patches to prevent potential command injection attacks that could lead to full system compromise.