CVE-2025-48384
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.044 · 91 %ileexploit · PoCDEEUNLRUUSadded 2025-08-25remediate by 2025-09-15
required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS · scored 2026-10-22
Git Link Following Vulnerability
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (42)
Public proof-of-concept and weaponised exploit code.
- Anezatraa/CVE-2025-48384-submoduleAnezatraa/CVE-2025-48384-submodulePoC · poc_in_github
- ECHO6789/CVE-2025-48384-submoduleECHO6789/CVE-2025-48384-submodulePoC · poc_in_github
- IK-20211125/CVE-2025-48384CVE-2025-48384 PoCPoC · poc_in_github
- MarcoTondolo/cve-2025-48384-pocMarcoTondolo/cve-2025-48384-pocPoC · poc_in_github
- NigelX/CVE-2025-48384漏洞测试PoC · poc_in_github
- acheong08/CVE-2025-48384Breaking git with a carriage return and cloning RCEPoC · poc_in_github
affected products (87)
Products and version ranges known to be affected.
- Microsoft Visual Studio 2015 Update 3all versionscert_bundDEcpe:/a:microsoft:visual_studio_2015:update_3
- Microsoft Visual Studio Code Python extension for Visual Studio Codeall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:python_extension_for_visual_studio_code
- Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
advisories (5)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0217Kwetsbaarheden verholpen in Microsoft Visual StudioNL2025-07-08csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in Visual Studio.
- WID-SEC-W-2025-1485Microsoft Developer Tools und git: Mehrere SchwachstellenDeutsch2025-07-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Microsoft Visual Studio Code und git ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu erzeugen und andere nicht spezifizierte Auswirkungen zu verursachen.
- WID-SEC-W-2025-1905IBM QRadar SIEM Komponente: Mehrere SchwachstellenDeutsch2025-08-25csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM Komponenten ausnutzen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.
- WID-SEC-W-2025-2059Apple Xcode: Mehrere SchwachstellenDeutsch2025-09-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple Xcode ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen und um Sicherheitsmechanismen zu umgehen.
- BIT-git-2025-48384Git allows arbitrary code execution through broken config quoting2025-07-10vendor · osvUS
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-48384cnnvd
- https://git-scm.com/Patchcnnvd
- https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-48384cnnvd
- https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9enisa_euvd
- http://seclists.org/fulldisclosure/2025/Sep/60Mailing ListThird Party Advisorynvd
- http://www.openwall.com/lists/oss-security/2025/07/08/4Mailing Listnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan