{"identifier":"CVE-2025-48384","cve":{"id":"CVE-2025-48384","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","published":"2025-07-08T19:15:42.800000+00:00","modified":"2026-09-24T13:10:00.320000+00:00","status":"Analyzed","score":8.0,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.43.7"},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.44.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.44.4"},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.45.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.45.4"},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.46.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.46.4"},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.47.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.47.3"},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.48.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.48.2"},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.49.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.49.1"},{"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.50.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"2.50.1"},{"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"26.0"}],"weaknesses":["CWE-436","CWE-59"],"references":[{"url":"https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Sep/60","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/08/4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}],"kev":{"cveID":"CVE-2025-48384","vendorProject":"Git","product":"Git","vulnerabilityName":"Git Link Following Vulnerability","dateAdded":"2025-08-25","shortDescription":"Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-09-15","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ; https://access.redhat.com/errata/RHSA-2025:13933 ; https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html ; https://linux.oracle.com/errata/ELSA-2025-11534.html ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48384","cwes":["CWE-59","CWE-436"]},"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-08-26T03:55:23.181071Z","id":"CVE-2025-48384","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionEndExcluding":"2.43.7","matchCriteriaId":"BB276680-D286-4DF6-BCB7-CAC1D9D77E08"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.44.0","versionEndExcluding":"2.44.4","matchCriteriaId":"856A8970-74E2-4F8F-A1A6-2AB1C0C87E45"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.45.0","versionEndExcluding":"2.45.4","matchCriteriaId":"6D1DB9BA-3D91-4F7D-931E-A664737129F0"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.46.0","versionEndExcluding":"2.46.4","matchCriteriaId":"01BDA55C-F398-4286-ABC6-979A783BDC65"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.47.0","versionEndExcluding":"2.47.3","matchCriteriaId":"FF4A2ACC-0996-4869-884D-734D6006C032"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.48.0","versionEndExcluding":"2.48.2","matchCriteriaId":"0DD21A83-8D62-4EE4-914B-B5ACA19A84A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.49.0","versionEndExcluding":"2.49.1","matchCriteriaId":"95C1825C-B7A2-46E9-93D7-2D196DB2515E"},{"vulnerable":true,"criteria":"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","versionStartIncluding":"2.50.0","versionEndExcluding":"2.50.1","matchCriteriaId":"18F948AD-22C0-4B2E-B497-899F3A94B70A"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*","versionEndExcluding":"26.0","matchCriteriaId":"37CC7F40-CC3A-4AEB-9260-B621FE64735A"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T16:17:12.974800+00:00","exploited":true,"kev_stale":false,"products":["git-scm / git","debian / debian linux","apple / xcode"],"priority":{"label":"Known exploitation: prioritize review","reasons":["CISA KEV lists real-world exploitation."]},"epss":{"probability":0.04379,"percentile":0.91234,"date":"2026-10-27","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"github.com","source_url":"https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","investigate_url":"https://investigate.aeglixmind.com/#github.com"},{"domain":"seclists.org","source_url":"http://seclists.org/fulldisclosure/2025/Sep/60","investigate_url":"https://investigate.aeglixmind.com/#seclists.org"},{"domain":"www.openwall.com","source_url":"http://www.openwall.com/lists/oss-security/2025/07/08/4","investigate_url":"https://investigate.aeglixmind.com/#www.openwall.com"},{"domain":"lists.debian.org","source_url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html","investigate_url":"https://investigate.aeglixmind.com/#lists.debian.org"},{"domain":"www.cisa.gov","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384","investigate_url":"https://investigate.aeglixmind.com/#www.cisa.gov"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2025-48384","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2025-48384","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2025-48384","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}