Executive brief
TortoiseGit is a popular Windows interface for the Git version control system. A vulnerability in its 'Blame' tool allows a malicious repository to trick the application into writing files to unauthorized locations on a user's computer. This occurs when a user interacts with a specially crafted file history, potentially allowing an attacker to place malicious scripts or overwrite system files if the user is lured into inspecting a compromised project.
Technical details
An argument injection vulnerability exists in TortoiseGitBlame due to improper neutralization of argument delimiters (CWE-88) when passing parameters to internal tools like TortoiseGitProc. An attacker can craft a repository where historical filenames contain injected command-line tokens such as /command, /revision, and /savepath. When a victim performs actions like 'Blame previous version' or 'Diff with previous' on a file with such a history, the application fails to properly escape the filename, allowing the attacker to redirect the command's output. This can be leveraged to achieve an arbitrary file write (e.g., saving a malicious .bat file to a startup folder). The vulnerability is fixed in version 2.19.0 by implementing proper parameter encoding via CCmdLineParser::EscapeValue.
Affected products
- TortoiseGit team TortoiseGit 1.8.10.0 to 2.18.0.1 (fixed in 2.19.0)
Timeline
- 2025-12-01: other: Version 2.18.0.1 released
- 2026-04-17: patched: Fix committed to repository
- 2026-06-24: disclosed: Public advisory and CVE assignment