CVE-2025-46334: GitHub: CVE-2025-46334 Git Malicious Shell Vulnerability

CVE-2025-46334 is a vulnerability in GitHub. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.37% probability of exploitation activity in the next 30 days, higher than 32% of all scored vulnerabilities. Microsoft released the fix on 8 July 2025 in the July 2025 Patch Tuesday. It affects 6 products in 1 product family (Developer Tools).

Key facts

CVE ID

CVE-2025-46334

Severity

N/A

Exploited in the wild

No

Publicly disclosed

No

Weakness

CWE-78

EPSS

0.37% (percentile 32%)

CISA KEV

Not listed

Released

8 July 2025

Last updated

22 August 2025

Patch Tuesday

July 2025 Patch Tuesday

Product families

Developer Tools

Description

CVE-2025-46334 is regarding a vulnerability in Git GUI (Windows only) where a malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. On Windows, path lookup can find such executables in the worktree. These programs are invoked when the user selects "Git Bash" or "Browse Files" from the menu. GitHub created this CVE on their behalf. The documented Visual Studio updates incorporate updates in GitK which address this vulnerability.

Please see CVE-2025-46334 for more information.

Affected products (6)

Developer Tools

NIST NVD data

NVD status

Deferred

NVD CVSS

8.6 (HIGH)

NVD weakness

CWE-78

Published to NVD

10 July 2025

NVD last modified

17 June 2026

References

• https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a1ccd2512072cf52835050f4c97a4fba9f0ec8f9
• https://github.com/j6t/git-gui/security/advisories/GHSA-7px4-9hg2-fvhx
• http://www.openwall.com/lists/oss-security/2025/07/08/4

Revision history

Related vulnerabilities

Other GitHub vulnerabilities

• CVE-2026-32631: GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes (High, CVSS 7.4, April 2026)
• CVE-2026-26030: GitHub: CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable (Critical, CVSS 9.9, March 2026)
• CVE-2025-48386: GitHub: CVE-2025-48386 Git Credential Helper Vulnerability (N/A)
• CVE-2025-48385: GitHub: CVE-2025-48385 Git Protocol Injection Vulnerability (N/A)
• CVE-2025-48384: GitHub: CVE-2025-48384 Git Symlink Vulnerability (N/A)
• CVE-2025-46835: GitHub: CVE-2025-46835 Git File Overwrite Vulnerability (N/A)
• CVE-2025-27614: GitHub: CVE-2025-27614 Gitk Arbitrary Code Execution Vulnerability (N/A)
• CVE-2025-27613: GitHub: CVE-2025-27613 Gitk Arguments Vulnerability (N/A)
• CVE-2024-50338: GitHub: CVE-2024-50338 Malformed URL allows information disclosure through git-credential-manager (High, CVSS 7.4, January 2025)
• CVE-2024-39684: Github: CVE-2024-39684 TenCent RapidJSON Elevation of Privilege Vulnerability (High, CVSS 7.8, July 2024)
• CVE-2024-38517: Github: CVE-2024-38517 TenCent RapidJSON Elevation of Privilege Vulnerability (High, CVSS 7.8, July 2024)
• CVE-2024-29187: GitHub: CVE-2024-29187 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM (High, CVSS 7.3, June 2024)

More from the July 2025 Patch Tuesday

• CVE-2025-49739: Visual Studio Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2025-49714: Visual Studio Code Python Extension Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2025-6965: Integer Truncation on SQLite (Critical, CVSS 9.8)
• CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability (Critical, CVSS 9)

All vulnerabilities of this release: July 2025 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2025-46334
• NIST NVD: CVE-2025-46334
• CVE.org record: CVE-2025-46334