Git GUI contains an argument injection vulnerability that allows an attacker to overwrite system files if a user is tricked into editing files within a malicious repository, posing a high risk to local workstation integrity.

This is an argument injection vulnerability (CWE-88) where Git GUI fails to properly sanitize input when handling directories. An unauthenticated attacker can trigger this by providing a crafted repository, requiring the user to perform an action within the GUI.

The ability to overwrite files for which the user has write permissions can lead to arbitrary code execution or the corruption of critical system configuration files. With a CVSS score of 8.5, this high severity flaw could result in complete compromise of the local developer environment, potentially facilitating lateral movement into production infrastructure if credentials are stored on the affected machine.

Immediate Action: Update Git GUI to the patched versions: 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, or 2.50.1.

Proactive Monitoring: Review file system integrity logs for unexpected modifications to system files or configuration files originating from the Git GUI process.

Compensating Controls: Advise developers to avoid cloning or opening repositories from untrusted or unknown sources until the software has been updated.

Public Exploit Available: Unknown.

Given the potential for arbitrary file overwrite and the high CVSS rating, administrators should prioritize updating all instances of Git GUI. Developers must exercise caution when working with untrusted repositories until the patch is applied, as the vulnerability is triggered through standard GUI operations.