CVE-2025-48384
Published: 08 July 2025
Summary
CVE-2025-48384 is a high-severity Link Following (CWE-59) vulnerability in Git-Scm Git. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked in the top 30.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and patching of the Git flaw in config and submodule path handling to prevent path alteration and unintended hook execution.
Vulnerability scanning detects systems running vulnerable Git versions affected by the config parsing issue.
Malicious code protection scans and blocks the executable post-checkout hook delivered through the exploited submodule.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables arbitrary code execution via malicious post-checkout hook in Git submodule after path manipulation; requires victim user interaction to init/update submodule from crafted repo config.
NVD Description
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF).…
more
When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Deeper analysisAI
CVE-2025-48384 affects Git, a fast, scalable, distributed revision control system. The vulnerability stems from Git's config value handling: trailing carriage return and line feed (CRLF) characters are stripped when reading configs, but values with a trailing carriage return (CR) are not quoted when writing, causing the CR to be lost on subsequent reads. During submodule initialization, a path with a trailing CR results in an altered path being used, leading to the submodule being checked out to an incorrect location. If a symlink exists from this altered path to the submodule's hooks directory and the submodule contains an executable post-checkout hook, the hook may execute unintentionally after checkout. The issue is rated 8.0 on CVSS 3.1 (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) and maps to CWE-59 and CWE-436.
Exploitation requires an attacker with low privileges, such as a repository collaborator who can contribute a malicious config. The attacker crafts a submodule path with a trailing CR in the config, along with a symlink pointing the resulting altered path to the submodule's hooks directory containing a malicious executable post-checkout hook. A victim must interact by initializing or updating the submodule (UI:R), enabling network-based attacks (AV:N) despite high complexity (AC:H). Successful exploitation executes arbitrary code with high impacts on confidentiality, integrity, and availability, with changed scope due to elevated privileges in the checkout process.
Git security advisories and patches address the issue by fixing the config handling and submodule path processing in versions v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. Mitigation guidance in the GitHub advisory (GHSA-vwqx-4fm8-6qc9), OSS-Security and Full Disclosure mailing lists, Debian LTS announcements, and CISA's Known Exploited Vulnerabilities catalog recommends immediate updates to patched versions and caution with untrusted repositories containing submodules.
The vulnerability's presence in CISA's KEV catalog points to real-world exploitation activity.
Details
- CWE(s)
- KEV Date Added
- 25 August 2025