CVE-2025-48384

CVE-2025-48384 is a high-severity (CVSS 8.0) link-following/path-interpretation flaw (CWE-59, CWE-436) in Git's config handling: trailing carriage returns are written unquoted into config files and stripped when the value is later read, so a submodule path containing a trailing CR resolves to a different location during submodule initialization. If an attacker crafts a repository whose submodule path ends in a CR and a symlink maps the altered path to the submodule's hooks directory, an executable post-checkout hook inside the submodule is unintentionally run after checkout, yielding arbitrary code execution on the machine running Git (network vector, user interaction required, scope changed, high C/I/A impact). Any user or CI/CD system running an affected Git release when cloning an untrusted repository with maliciously crafted submodule configuration is exposed; CISA lists Git as the affected product, with CPEs also covering Git as packaged by Debian and bundled with Apple's Xcode. The flaw is being exploited in the wild: CISA added it to the KEV catalog on 2025-08-25, news outlets report active exploitation leading to RCE, EPSS is 4.1% (90th percentile), ransomware association is unknown, and no public proof-of-concept is known.

What to do: Upgrade Git immediately to 2.50.1 or to the fixed release matching your maintenance line (2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, or 2.49.1); on Debian apply the distribution security update and on macOS update Xcode/Command Line Tools via Apple's security update. As an interim check, inspect .gitmodules and repo configuration for submodule paths containing trailing carriage-return characters before initializing submodules from untrusted repositories. Federal agencies must patch per the KEV listing (added 2025-08-25) and BOD 22-01 guidance.