CVE-2024-32004

Deeper analysis

Git is a widely used revision control system affected by CVE-2024-32004, a vulnerability present in all versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. The flaw allows an attacker to craft a local repository such that cloning it triggers execution of arbitrary code on the victim's system during the clone operation itself. It is tracked under CWE-114 and carries a CVSS 3.1 score of 8.1 reflecting local attack vector, high complexity, no privileges or user interaction required, and changed scope with high impact on confidentiality, integrity, and availability.

An attacker who controls or can influence a repository can prepare it to exploit the issue; any user who subsequently clones that repository will execute the attacker's code in the context of the clone process. Because the attack requires the victim to initiate a clone from the malicious source, it is most relevant in environments where developers or automated systems fetch repositories from untrusted or attacker-controlled locations.

Official patches addressing the root cause were released in the listed Git versions, and the Git project advisory along with downstream distributions such as Debian recommend avoiding clones from untrusted sources as an immediate workaround. The referenced Git commit and security advisory provide the specific remediation details.

EPSS for this CVE rose from a low baseline to a peak of 0.0664 on 2025-12-11 before receding to the current value of 0.0244, indicating that exploitation interest increased well after initial disclosure.