CVE-2025-48384

Name of the Vulnerable Software and Affected Versions Git versions 2.43.7 through 2.50.1

Description Git contains a link following vulnerability stemming from inconsistent handling of carriage return characters in configuration files. This flaw can lead to arbitrary file write and potential remote code execution (RCE) on Unix-like systems when cloning repositories with malicious submodules. The vulnerability is actively exploited and a proof-of-concept exploit is available. The flaw arises because Git strips trailing carriage return (CR) characters when reading configuration values but does not quote them when writing, leading to altered paths during submodule initialization and potential execution of malicious hooks. Lazarus Group is actively exploiting this vulnerability in phishing campaigns targeting the cryptocurrency sector.

Recommendations Update Git to version 2.50.1 or later.