CVE-2025-48384
Git Link Following Vulnerability
Description
CVE-2025-48384 is a high-severity vulnerability in Git that combines improper link resolution with an interpretation conflict in configuration handling to achieve arbitrary code execution. When initializing a submodule whose path contains a trailing carriage return (CR), Git's config parser strips the CR on read but not on write, causing the submodule to be checked out to an altered path. If a symlink redirects this altered path to the submodule hooks directory, a malicious post-checkout hook can be executed unintentionally. With a CVSS v3.1 base score of 8.0, the attack requires user interaction (cloning or updating a malicious repository) and high complexity but achieves full system compromise. CISA has added CVE-2025-48384 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2025, and its EPSS score of 0.46% at the 63rd percentile reflects the higher complexity barrier to exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| git-scm | git | < 2.43.7; >= 2.44.0, < 2.44.4; >= 2.45.0, < 2.45.4; >= 2.46.0, < 2.46.4; >= 2.47.0, < 2.47.3; >= 2.48.0, < 2.48.2; >= 2.49.0, < 2.49.1; >= 2.50.0, < 2.50.1 |
| debian | debian linux | 11.0 |
| apple | xcode | < 26.0 |
References
- https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9(Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Sep/60(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2025/07/08/4(Mailing List)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384(US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CVE-2025-48384 involves CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack. In this vulnerability, Git follows a symbolic link when checking out a submodule to an altered path, inadvertently redirecting the checkout operation to the submodule hooks directory. The symlink allows an attacker-controlled post-checkout hook to be placed where Git will automatically execute it.
Learn more: CWE-59 — Improper Link Resolution Before File Access
CWE-436: Interpretation Conflict
CVE-2025-48384 also involves CWE-436 (Interpretation Conflict). Git's config reader strips trailing carriage return and line feed characters, but the config writer does not properly quote values containing a trailing CR. This discrepancy between the write and read operations causes the submodule path to be silently altered when the configuration is later read, creating the path mismatch that enables the symlink attack.
Learn more: CWE-436 — Interpretation Conflict
Impact Analysis
CVE-2025-48384 poses a severe impact despite its higher complexity requirements. The attack is network-accessible (AV:N) but requires high complexity (AC:H) because the attacker must craft a repository with a specific combination of a trailing-CR submodule path, a symlink, and a malicious hook script. Low privileges (PR:L) are needed, and user interaction (UI:R) is required in the form of cloning or updating the malicious repository. Critically, the scope is changed (S:C), meaning the vulnerability can affect resources beyond Git itself. Confidentiality (High): When the malicious post-checkout hook executes, it runs with the full privileges of the user who performed the Git operation, granting access to all files, credentials, SSH keys, and environment variables accessible to that user. Integrity (High): The attacker's hook script can modify any file the user has write access to, install persistent backdoors, alter other repositories, or tamper with build artifacts. Availability (High): The hook can disrupt the development environment, corrupt repositories, or execute destructive operations. The vulnerability is particularly dangerous in CI/CD pipelines where Git operations run with elevated privileges and process untrusted repositories automatically.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-48384 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2025. The EPSS score of 0.46% at the 63rd percentile suggests that while exploitation is occurring, it is not yet widespread, likely due to the high attack complexity requirement. The Git security advisory (GHSA-vwqx-4fm8-6qc9) provides detailed technical information about the vulnerability. The attack requires a specifically crafted repository, which limits exploitation to scenarios where a user clones or fetches from an attacker-controlled or compromised repository. Supply chain attack scenarios are the primary concern, particularly when developers clone repositories from untrusted sources or when CI/CD systems automatically process external contributions. Apple has also addressed this vulnerability in Xcode 26.0, indicating the broad impact across development toolchains.
Remediation
-
Update Git immediately. Upgrade to one of the fixed versions: v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, or v2.50.1, matching your installed major version. Apple Xcode users should upgrade to Xcode 26.0 or later.
-
Review submodule configurations in existing repositories. Inspect
.gitmodulesfiles for submodule paths containing unusual characters, particularly trailing carriage returns. Rungit submodule statusand compare the output against expected submodule paths to detect any anomalies. -
Restrict untrusted repository operations. Exercise caution when cloning repositories from untrusted sources. In CI/CD environments, configure Git to disable hooks when processing untrusted repositories using
git config --global core.hooksPath /dev/nullor equivalent isolation mechanisms. -
Audit CI/CD pipeline configurations. Review automated build systems that clone external repositories to ensure they run Git operations in sandboxed environments with minimal privileges. Implement repository allowlists for CI/CD pipelines and validate submodule URLs before initialization.
-
Monitor for suspicious Git activity. Watch for unexpected hook execution during Git operations. Review system logs for processes spawned by Git that should not occur during normal clone or checkout operations.
Technical Details
CVE-2025-48384 exploits a subtle interaction between Git's configuration handling and symlink resolution. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H reflects the high complexity (AC:H) and user interaction requirement (UI:R) alongside the changed scope (S:C) that enables impact beyond the vulnerable component. The attack leverages CWE-436 (Interpretation Conflict): Git's config reader strips trailing CRLF characters from values, but the config writer does not quote values containing a trailing CR, causing the CR to be silently lost when the config is subsequently read. An attacker crafts a repository with a submodule whose path includes a trailing CR character. When Git writes this path to the configuration, the trailing CR is preserved unquoted. When the configuration is later read, the CR is stripped, resulting in a different path than originally specified. The attacker also includes a symlink in the repository that points the altered (CR-stripped) path to the .git/modules/<submodule>/hooks/ directory. When Git initializes the submodule and checks it out to the altered path, it follows the symlink and places the submodule contents, including a malicious post-checkout hook, into the hooks directory. Git then automatically executes this hook, achieving arbitrary code execution. The vulnerability affects all Git versions prior to the fix across eight release branches.
Frequently Asked Questions
Is CVE-2025-48384 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-48384 to the Known Exploited Vulnerabilities catalog. The exploitation requires a user to clone or update a malicious repository, which makes supply chain attacks and compromised repositories the primary attack vectors.
What products are affected by CVE-2025-48384?
Git versions prior to 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1 are affected. Additionally, Debian Linux 11.0 and Apple Xcode prior to version 26.0 are affected through their bundled Git distributions.
How do I fix CVE-2025-48384?
Update Git to the latest patched version for your release branch. Apple users should update Xcode to version 26.0 or later. Review CI/CD pipelines that process untrusted repositories and implement sandboxing for Git operations.
How severe is CVE-2025-48384?
CVE-2025-48384 has a CVSS v3.1 base score of 8.0 (High severity) with a changed scope, meaning exploitation can affect resources beyond Git itself. While the attack requires high complexity and user interaction, successful exploitation achieves full code execution with the victim's privileges, making it a serious supply chain risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.