{"id":"CVE-2025-48384","title":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals","summary":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return a…","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-59","CWE-436"],"vendor":"git-scm","product":"git","affected":["git < 2.43.7","git >= 2.44.0, < 2.44.4","git >= 2.45.0, < 2.45.4","git >= 2.46.0, < 2.46.4","git >= 2.47.0, < 2.47.3","git >= 2.48.0, < 2.48.2","git >= 2.49.0, < 2.49.1","git >= 2.50.0, < 2.50.1","debian_linux = 11.0","xcode < 26.0"],"patched":["git 2.50.1","xcode 26.0"],"published":"2025-07-08","updated":"2026-09-24","sourceUpdated":"2026-09-24T13:10:00.320","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-48384","references":[{"url":"https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","label":"security-advisories@github.com"},{"url":"http://seclists.org/fulldisclosure/2025/Sep/60","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2025/07/08/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.04109,"epssPercentile":0.90331,"kev":true,"kevDateAdded":"2025-08-25","kevDueDate":"2025-09-15","kevRansomware":false,"exploited":true,"exploits":{"github":42,"githubRepos":["https://github.com/acheong08/CVE-2025-48384","https://github.com/fishyyh/CVE-2025-48384","https://github.com/kallydev/cve-2025-48384-hook"],"checkedAt":"2026-09-24T13:43:59.532Z"},"exploitAvailable":true,"ingestedAt":"2026-09-24T13:43:25.658Z","slug":"CVE-2025-48384","body":"## Overview\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.\n\n## Affected\n\n- `git < 2.43.7`\n- `git >= 2.44.0, < 2.44.4`\n- `git >= 2.45.0, < 2.45.4`\n- `git >= 2.46.0, < 2.46.4`\n- `git >= 2.47.0, < 2.47.3`\n- `git >= 2.48.0, < 2.48.2`\n- `git >= 2.49.0, < 2.49.1`\n- `git >= 2.50.0, < 2.50.1`\n- `debian_linux = 11.0`\n- `xcode < 26.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `git 2.50.1`\n- `xcode 26.0`","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":44,"likelihood":0.8,"exploitation":25,"ransomware":0},"changes":[]}