CVE-2025-48384

Published Jul 8, 2025

Last updated 5 months ago

Exploit known CVSS high 8.0

Git

Zero-day

Overview

Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Source: security-advisories@github.com
NVD status: Analyzed
Products: git, debian_linux, xcode

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8
Impact score: 6
Exploitability score: 1.3
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Git Link Following Vulnerability
Exploit added on: Aug 25, 2025
Exploit action due: Sep 15, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-59

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BB276680-D286-4DF6-BCB7-CAC1D9D77E08",
            "versionEndExcluding": "2.43.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "856A8970-74E2-4F8F-A1A6-2AB1C0C87E45",
            "versionEndExcluding": "2.44.4",
            "versionStartIncluding": "2.44.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6D1DB9BA-3D91-4F7D-931E-A664737129F0",
            "versionEndExcluding": "2.45.4",
            "versionStartIncluding": "2.45.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "01BDA55C-F398-4286-ABC6-979A783BDC65",
            "versionEndExcluding": "2.46.4",
            "versionStartIncluding": "2.46.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FF4A2ACC-0996-4869-884D-734D6006C032",
            "versionEndExcluding": "2.47.3",
            "versionStartIncluding": "2.47.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0DD21A83-8D62-4EE4-914B-B5ACA19A84A2",
            "versionEndExcluding": "2.48.2",
            "versionStartIncluding": "2.48.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "95C1825C-B7A2-46E9-93D7-2D196DB2515E",
            "versionEndExcluding": "2.49.1",
            "versionStartIncluding": "2.49.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "18F948AD-22C0-4B2E-B497-899F3A94B70A",
            "versionEndExcluding": "2.50.1",
            "versionStartIncluding": "2.50.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "37CC7F40-CC3A-4AEB-9260-B621FE64735A",
            "versionEndExcluding": "26.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References