What is the CVSS score of CVE-2026-11968?

CVE-2026-11968 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-11968?

Yes, a patch is available for CVE-2026-11968. Update the affected software to the latest version immediately.

TortoiseGit CVE-2026-11968

EUVD-2026-38733 MEDIUM

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-06-24 GitLab

GHSA-2h5c-f427-3wjr

Code Injection Tortoisegit

5.5

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.5 MEDIUM

AV:L because the malicious repo must be local; UI:R because TortoiseGitBlame must be actively invoked; PR:N as no privileges required on victim system; I:H for arbitrary file write; C and A both N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 24, 2026 - 11:01 EUVD

Analysis Generated

Jun 24, 2026 - 10:31 vuln.today

DescriptionCVE.org

Argument Injection in TortoiseGitBlame via Malicious Git History Filenames Leads to Arbitrary File Write in TortoiseGit

AnalysisAI

Arbitrary file write in TortoiseGit's TortoiseGitBlame component is triggered when a user opens a malicious git repository and invokes blame history on a file whose historical filenames contain argument injection payloads. The injected arguments are passed unsanitized to underlying git subprocess calls, allowing an attacker-controlled repository to write files to arbitrary paths on the victim's Windows filesystem. No public exploit has been identified at time of analysis, and no KEV listing exists; however, a fix commit is available upstream.

Technical ContextAI

TortoiseGit is a Windows shell extension providing GUI integration for Git, including TortoiseGitBlame for per-line annotation history. The CPE cpe:2.3:a:tortoisegit_team:tortoisegit:*:*:*:*:*:*:*:* indicates all tracked versions are affected with no upper-bound cutoff confirmed. CWE-88 (Argument Injection or Modification) describes the root cause: when TortoiseGitBlame constructs git subprocess invocations using filenames retrieved from git repository history, specially crafted filenames containing argument delimiters or flag-like strings are passed without proper sanitization. This allows the attacker-controlled filename to introduce additional command-line arguments - such as output redirection flags or path parameters - into the underlying git invocation, resulting in writes to attacker-specified filesystem paths.

RemediationAI

An upstream fix is available as commit 7052e3ef61cd104f8a90fb3dcdfb403cbc8c1773 in the TortoiseGit GitLab repository (https://gitlab.com/tortoisegit/tortoisegit/-/commit/7052e3ef61cd104f8a90fb3dcdfb403cbc8c1773); a specific patched release version is not independently confirmed from available input data - users should monitor https://tortoisegit.org/issue/4269 for an official release announcement. As a compensating control until a patched release is confirmed, avoid using TortoiseGitBlame on repositories sourced from untrusted parties, unknown sources, or received via email or external collaboration. Users who cannot restrict repository sources should consider disabling or restricting use of the TortoiseGitBlame feature entirely until a patched version is released. Note that simply cloning a malicious repository does not trigger the vulnerability - only actively invoking TortoiseGitBlame on an affected file does.