CVE-2025-48384 (GCVE-0-2025-48384)

Vulnerability from cvelistv5 – Published: 2025-07-08 18:23 – Updated: 2026-02-26 17:51
VLAI CISA Previdian
Title
Git allows arbitrary code execution through broken config quoting
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
SSVC
Exploitation: active Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-26 03:55 UTC
CWE
  • CWE-436 - Interpretation Conflict
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7881 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
git git Affected: < 2.43.7
Affected: >= 2.44.0-rc0, < 2.44.4
Affected: >= 2.45.0-rc0, < 2.45.4
Affected: >= 2.46.0-rc0, < 2.46.4
Affected: >= 2.47.0-rc0, < 2.47.3
Affected: >= 2.48.0-rc0, < 2.48.2
Affected: >= 2.49.0-rc0, < 2.49.1
Affected: >= 2.50.0-rc0, < 2.50.1
guessed Create a notification for this product.
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: a135943d-7c47-40d8-95e1-7b3e19a86875

Vulnerability ID: CVE-2025-48384

Status: Confirmed

Status Updated: 2025-08-25 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2025-08-25
Asserted: 2025-08-25
Scope
Notes: Git Link Following Vulnerability | Affected: Git / Git | Description: Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2025-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ; https://access.redhat.com/errata/RHSA-2025:13933 ; https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html ; https://linux.oracle.com/errata/ELSA-2025-11534.html ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48384
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-59 CWE-436
Feed CISA Known Exploited Vulnerabilities Catalog
Product Git
Due Date 2025-09-15
Date Added 2025-08-25
Vendorproject Git
Vulnerabilityname Git Link Following Vulnerability
Knownransomwarecampaignuse Unknown
References
Created: 2026-02-02 12:25 UTC | Updated: 2026-11-04 13:37 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 7e9f474e-e221-4b47-a7ea-b68c69cb8115

Vulnerability ID: CVE-2025-48384

Status: Confirmed

Status Updated: 2026-06-01 10:39 UTC

Exploited: Yes

Timestamps
First Seen: 2026-06-01
Asserted: 2026-06-01
Scope
Notes: KEVIntel entry: Git allows arbitrary code execution through broken config quoting | Affected: git / git | CVSS: 8.0 (HIGH) | EPSS: 0.02775 | Used in malware: unknown | Not yet in CISA KEV: False
Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title Git allows arbitrary code execution through broken config quoting
Vendor git
Product git
Added Date 2026-06-01T10:39:30.704Z
Cvss Score 8.0
Epss Score 0.02775
Cvss Severity HIGH
Epss Percentile 0.84478
Used In Malware unknown
Ahead Of Cisa Kev 
{
  "count": 1,
  "unit": "day"
}
Not Yet In Cisa Kev False
References
Created: 2026-06-23 14:03 UTC | Updated: 2026-07-10 06:14 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-48384",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-26T03:55:23.181071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-08-25",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:51:05.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-08-25T00:00:00.000Z",
            "value": "CVE-2025-48384 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:11:00.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.43.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T18:23:48.710Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
        }
      ],
      "source": {
        "advisory": "GHSA-vwqx-4fm8-6qc9",
        "discovery": "UNKNOWN"
      },
      "title": "Git allows arbitrary code execution through broken config quoting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-48384",
    "datePublished": "2025-07-08T18:23:48.710Z",
    "dateReserved": "2025-05-19T15:46:00.397Z",
    "dateUpdated": "2026-02-26T17:51:05.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2025-48384",
      "cwes": [
        "CWE-59",
        "CWE-436"
      ],
      "dateAdded": "2025-08-25",
      "dueDate": "2025-09-15",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ; https://access.redhat.com/errata/RHSA-2025:13933 ; https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html ; https://linux.oracle.com/errata/ELSA-2025-11534.html ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48384",
      "product": "Git",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Git contains a link following vulnerability that stems from Git\u2019s inconsistent handling of carriage return characters in configuration files.",
      "vendorProject": "Git",
      "vulnerabilityName": "Git Link Following Vulnerability"
    },
    "epss": {
      "cve": "CVE-2025-48384",
      "date": "2026-11-14",
      "epss": "0.04484",
      "percentile": "0.91623"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "git",
                "vendor": "git",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.43.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cisaActionDue": "2025-09-15",
        "cisaExploitAdd": "2025-08-25",
        "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "cisaVulnerabilityName": "Git Link Following Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BB276680-D286-4DF6-BCB7-CAC1D9D77E08",
                    "versionEndExcluding": "2.43.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "856A8970-74E2-4F8F-A1A6-2AB1C0C87E45",
                    "versionEndExcluding": "2.44.4",
                    "versionStartIncluding": "2.44.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D1DB9BA-3D91-4F7D-931E-A664737129F0",
                    "versionEndExcluding": "2.45.4",
                    "versionStartIncluding": "2.45.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "01BDA55C-F398-4286-ABC6-979A783BDC65",
                    "versionEndExcluding": "2.46.4",
                    "versionStartIncluding": "2.46.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FF4A2ACC-0996-4869-884D-734D6006C032",
                    "versionEndExcluding": "2.47.3",
                    "versionStartIncluding": "2.47.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0DD21A83-8D62-4EE4-914B-B5ACA19A84A2",
                    "versionEndExcluding": "2.48.2",
                    "versionStartIncluding": "2.48.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "95C1825C-B7A2-46E9-93D7-2D196DB2515E",
                    "versionEndExcluding": "2.49.1",
                    "versionStartIncluding": "2.49.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "18F948AD-22C0-4B2E-B497-899F3A94B70A",
                    "versionEndExcluding": "2.50.1",
                    "versionStartIncluding": "2.50.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "37CC7F40-CC3A-4AEB-9260-B621FE64735A",
                    "versionEndExcluding": "26.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
          },
          {
            "lang": "es",
            "value": "Git es un sistema de control de versiones distribuido, r\u00e1pido y escalable, con un conjunto de comandos excepcionalmente completo que proporciona operaciones de alto nivel y acceso completo a su funcionamiento interno. Al leer un valor de configuraci\u00f3n, Git elimina cualquier retorno de carro y avance de l\u00ednea (CRLF) final. Al escribir una entrada de configuraci\u00f3n, los valores con un CR final no se entrecomillan, lo que provoca que el CR se pierda al leer la configuraci\u00f3n posteriormente. Al inicializar un subm\u00f3dulo, si la ruta del subm\u00f3dulo contiene un CR final, se lee la ruta modificada, lo que provoca que el subm\u00f3dulo se extraiga a una ubicaci\u00f3n incorrecta. Si existe un enlace simb\u00f3lico que apunta la ruta modificada al directorio de ganchos del subm\u00f3dulo, y este contiene un gancho ejecutable posterior a la extracci\u00f3n, el script podr\u00eda ejecutarse accidentalmente despu\u00e9s de la extracci\u00f3n. Esta vulnerabilidad se ha corregido en v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1 y v2.50.1."
          }
        ],
        "id": "CVE-2025-48384",
        "lastModified": "2026-09-24T13:10:00.320",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.3,
              "impactScore": 6.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-48384",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-26T03:55:23.181071Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-07-08T19:15:42.800",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-59"
              },
              {
                "lang": "en",
                "value": "CWE-436"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-04T21:39:55+00:00",
      "cve": "CVE-2025-48384",
      "id": "CVE-2025-48384",
      "initial_release_date": "2025-07-08T18:23:48.710000+00:00",
      "product_status:fixed": "587",
      "product_status:known_affected": "13",
      "product_status:known_not_affected": "655",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "git: Git arbitrary code execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-48384.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-21T00:18:27Z",
      "cve": "CVE-2025-48384",
      "id": "CVE-2025-48384",
      "initial_release_date": "2025-07-09T23:22:33Z",
      "product_status:known_affected": "214",
      "product_status:recommended": "474",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-48384",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2025/cve-2025-48384.json",
      "version": "30"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-04T21:11:00.255Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
              },
              {
                "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
              },
              {
                "url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-48384",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-08-26T03:55:23.181071Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2025-08-25",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-07-08T18:35:20.601Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2025-08-25T00:00:00.000Z",
                "value": "CVE-2025-48384 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "git",
              "vendor": "git",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.43.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-436",
                  "description": "CWE-436: Interpretation Conflict",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-59",
                  "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-07-08T18:23:48.710Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
            }
          ],
          "source": {
            "advisory": "GHSA-vwqx-4fm8-6qc9",
            "discovery": "UNKNOWN"
          },
          "title": "Git allows arbitrary code execution through broken config quoting"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-48384",
        "datePublished": "2025-07-08T18:23:48.710Z",
        "dateReserved": "2025-05-19T15:46:00.397Z",
        "dateUpdated": "2026-02-26T17:51:05.174Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.