Skip to main content

Git CVE-2025-48384

| EUVDEUVD-2025-20677 HIGH
Improper Link Resolution Before File Access (CWE-59)
2025-07-08 security-advisories@github.com
Information Disclosure Apple Debian Debian Linux Git Xcode Git Scm
8.0
CVSS 3.1 · Vendor: github
View

Vulnerability Assessment

Weakness
CWE
CWE-59
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
Impact

CVSS 8.0 (High). KEV-listed — actively exploited. Git is the most widely used VCS. Config injection enables code execution via hooks. Affects development environments and CI/CD pipelines. Credential theft through helper manipulation.
Exploit ScenarioDerived

An attacker who can influence Git config values (through a cloned repository's .gitmodules, a crafted clone URL, or a Git server response) injects a trailing CR that allows escaping the current config line. Additional injected config entries set core.hooksPath to a directory containing malicious hooks, or modify credential.helper to redirect credentials to the attacker. On the next Git operation (pull, push, commit), the malicious hook executes or credentials are stolen.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

Git contains a CRLF injection vulnerability (CVE-2025-48384, CVSS 8.0) in its config handling that allows attackers to escape header lines and modify config values. KEV-listed, this vulnerability in the world's most widely used version control system enables config injection attacks that could lead to arbitrary code execution through Git hooks, credential theft, or repository manipulation.

Earlier versions of this analysis (1)
v1 Mar 16, 2026 - 04:21 CVSS 8.0

Git's config writing logic (CWE-59) fails to properly quote values containing trailing carriage returns, allowing attackers to inject additional config entries that modify Git's behavior, potentially enabling code execution or credential theft.

RemediationAI

Update Git immediately. Review .gitconfig and repository configs for suspicious entries. Audit core.hooksPath and credential.helper settings. Enterprise: deploy Git updates through software management.

Affected VersionsENISA

Git 2.50.0-rc0, < 2.50.1
Git 2.49.0-rc0, < 2.49.1
Git 2.46.0-rc0, < 2.46.4
Git 2.45.0-rc0, < 2.45.4
Git 2.48.0-rc0, < 2.48.2
Git 2.44.0-rc0, < 2.44.4
Git 2.47.0-rc0, < 2.47.3
Git < 2.43.7

Affected Packages

euvd git fix: 2.43.7
euvd git_2_44_0_rc0 fix: 2.44.4
euvd git_2_45_0_rc0 fix: 2.45.4
euvd git_2_46_0_rc0 fix: 2.46.4
euvd git_2_47_0_rc0 fix: 2.47.3
euvd git_2_48_0_rc0 fix: 2.48.2
euvd git_2_49_0_rc0 fix: 2.49.1
euvd git_2_50_0_rc0 fix: 2.50.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 8 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

When Git writes a config entry, it strips trailing CRLF from values but does not quote values containing only a trailing CR. This allows an attacker who can influence config values to inject additional lines into the git config file. Injected config entries could: set malicious hooks (core.hooksPath), modify credential helpers (credential.helper), change remote URLs, or alter other security-sensitive settings. Git config is implicitly trusted by Git operations.

Know when Git gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.0 HIGH
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Ubuntu HIGH
SUSE 7.8 HIGH
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Red Hat 8.0 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Added to CISA KEV
Nov 06, 2025 - 14:52 cisa
CISA KEV
CVE Published
Jul 08, 2025 - 19:15 nvd
HIGH 8.0

DescriptionCVE.org

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Executive ViewAI

Why It Matters

Organizations using Git face notable risk from CVE-2025-48384 rated CVSS 8.0. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.5%
Top 36% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org CISA KEV EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV Yes
Public POC No
EPSS 0.5%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

90
Low Medium High Critical
KEV: +50
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Git

View all
CVE-2017-1000117 HIGH POC
8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
CVE-2017-8386 HIGH POC
8.8 Jun 01

git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x be
CVE-2018-17456 CRITICAL POC
9.8 Oct 06

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x be
CVE-2015-7545 CRITICAL
9.8 Apr 13

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x
CVE-2021-21300 HIGH POC
7.5 Mar 09

Git is an open-source distributed revision control system. Rated high severity (CVSS 7.5), this vulnerability is remotel
CVE-2016-2324 CRITICAL
9.8 Apr 08

Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) ma
CVE-2022-25648 CRITICAL POC
9.8 Apr 19

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. Rated critical severity (C
CVE-2016-2315 CRITICAL
9.8 Apr 08

revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary c
CVE-2014-9938 HIGH POC
8.8 Mar 20

contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a mali
CVE-2019-19604 HIGH POC
7.8 Dec 11

Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before

CVE-2018-11235 HIGH POC
7.8 May 30

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote
CVE-2022-36883 HIGH POC
7.5 Jul 27

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds o

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Ubuntu

Priority: High
git
Release Status Version
bionic released 1:2.17.1-1ubuntu0.18+esm2
focal released 1:2.25.1-1ubuntu3.14+esm1
jammy released 1:2.34.1-1ubuntu1.13
noble released 1:2.43.0-1ubuntu7.3
oracular released 1:2.45.2-1ubuntu1.2
plucky released 1:2.48.1-0ubuntu1.1
upstream released 2.43.7
xenial released 1:2.7.4-0ubuntu1.10+esm9
USN-7626-1

Debian

Bug #1108983
git
Release Status Fixed Version Urgency
bullseye fixed 1:2.30.2-1+deb11u5 -
bullseye (security) fixed 1:2.30.2-1+deb11u5 -
bookworm vulnerable 1:2.39.5-0+deb12u3 -
bookworm (security) vulnerable 1:2.39.5-0+deb12u2 -
trixie fixed 1:2.47.3-0+deb13u1 -
forky fixed 1:2.51.0-1 -
sid fixed 1:2.53.0-1 -
(unstable) fixed 1:2.50.1-0.1 -
DLA-4323-1

SUSE

Severity: High
Product Status
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 7 LTSS Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:11462 ADVISORY https://access.redhat.com/errata/RHSA-2025:11533 ADVISORY https://access.redhat.com/errata/RHSA-2025:11534 ADVISORY https://access.redhat.com/errata/RHSA-2025:11686 ADVISORY https://access.redhat.com/errata/RHSA-2025:11688 ADVISORY https://access.redhat.com/errata/RHSA-2025:11793 ADVISORY https://access.redhat.com/errata/RHSA-2025:11794 ADVISORY https://access.redhat.com/errata/RHSA-2025:11795 ADVISORY https://access.redhat.com/errata/RHSA-2025:11796 ADVISORY https://access.redhat.com/errata/RHSA-2025:11800 ADVISORY https://access.redhat.com/errata/RHSA-2025:11801 ADVISORY https://access.redhat.com/errata/RHSA-2025:13276 ADVISORY https://access.redhat.com/errata/RHSA-2025:13325 ADVISORY https://access.redhat.com/errata/RHSA-2025:13933 ADVISORY https://access.redhat.com/errata/RHSA-2025:14059 ADVISORY https://access.redhat.com/errata/RHSA-2025:14396 ADVISORY https://access.redhat.com/errata/RHSA-2025:14853 ADVISORY https://access.redhat.com/errata/RHSA-2025:14858 ADVISORY https://access.redhat.com/errata/RHSA-2025:15308 ADVISORY https://access.redhat.com/errata/RHSA-2025:15672 ADVISORY https://access.redhat.com/errata/RHSA-2025:15827 ADVISORY https://access.redhat.com/errata/RHSA-2025:15828 ADVISORY https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ADVISORY https://security-tracker.debian.org/tracker/dla-4323-1 ADVISORY https://ubuntu.com/security/notices/USN-7626-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03012/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03022/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03037/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20721/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20855/ REF http://seclists.org/fulldisclosure/2025/Sep/60 REF http://www.openwall.com/lists/oss-security/2025/07/08/4 REF https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy