CVE-2025-48384highunder attackCWE-436 CWE-59

CVE-2025-48384: high-severity vulnerability in git

Git allows arbitrary code execution through broken config quoting

Published 08 Jul 2025 · Updated 26 Feb 2026

Follow this CVE + Monitor git + Monitor git

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

73Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.1epss 4.4%

from disclosure to weaponsame day

Published on NVDJul 8

1st PoCJul 8

CISA KEV+48d

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

2 products (14 components)

Red Hat Enterprise Linux 6 · Red Hat OpenShift Container Platform 4

workaround: To mitigate this issue, avoid using --recurse-submodules when cloning repositories from untrusted sources; instead, clone normally and only initialize or update submodules manually after reviewing them.

Fixed

27 products (587 components)

Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream E4S (v.8.6) · Red Hat Enterprise Linux AppStream E4S (v.9.0) · Red Hat Enterprise Linux AppStream E4S (v.9.2) · and others 22

fix ↗

Not affected

2 products (655 components) — because the vulnerable code is not present in the product

Red Hat OpenShift Container Platform 4.18 · Red Hat OpenShift Dev Spaces

Action required by CISAfederal deadline: 2025-09-15

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Git fails to properly quote config values with trailing carriage returns, causing submodules to be checked out to wrong locations. If a symlink redirects to Git hooks, an attacker could trick Git into executing malicious scripts during submodule setup.

Technical detail

When Git reads config values, it strips CRLF characters, but fails to quote values containing trailing CR on write, causing path misinterpretation during submodule initialization. An attacker can craft a repository with a submodule path containing trailing CR that, combined with a symlink pointing to the hooks directory, triggers unintended execution of post-checkout hooks. Requires user to clone a malicious repository or update submodules (CWE-436: Interpretation Conflict, CWE-59: Improper Link Resolution).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

git · git

public PoCs found — 69

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — git

In the same product, most dangerous first.

CVE-2021-21300HIGHmalicious repositories can execute remote code while cloningEPSS 88.5%CVE-2022-23521CRITICALgitattributes parsing integer overflow in gitEPSS 56.3%CVE-2023-25652HIGH"git apply --reject" partially-controlled arbitrary file writeEPSS 51.9%CVE-2022-41903CRITICALInteger overflow in `git archive`, `git log --format` leading to RCE in gitEPSS 44.3%CVE-2024-32002CRITICALGit's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code ExecutionEPSS 29.2%CVE-2020-5260CRITICALmalicious URLs may cause Git to present stored credentials to the wrong serverEPSS 14.9%

References

http://seclists.org/fulldisclosure/2025/Sep/60 https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384 http://www.openwall.com/lists/oss-security/2025/07/08/4