PT-2025-28647 · Git +10 · Git +10
Dgl
·
Published
2025-07-08
·
Updated
2025-08-26
·
CVE-2025-48384
8.0
High
| Base vector | Vector | AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
**Name of the Vulnerable Software and Affected Versions:**
Git versions 2.43.7 through 2.50.1
**Description:**
Git is a distributed revision control system susceptible to a flaw in handling carriage return characters (`r`). Specifically, when writing configuration entries, trailing carriage returns are not properly quoted, leading to their loss when the configuration is read. When initializing a submodule, if the submodule path contains a trailing carriage return, the altered path is read, potentially causing the submodule to be checked out to an incorrect location. If a symlink exists pointing to the submodule hooks directory, and that directory contains an executable post-checkout hook, the script may be unintentionally executed. This can lead to remote code execution (RCE) when cloning malicious repositories with the `--recursive` flag on Unix-like systems.
**Recommendations:**
Git versions prior to 2.50.1 should be updated to version 2.50.1 or later to address this issue.
Fix
RCE
Link Following
Related Identifiers
Affected Products
References · 158
- https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9⭐ 56156 🔗 26566 · Vendor Advisory
- https://osv.dev/vulnerability/USN-7626-3 · Vendor Advisory
- https://bdu.fstec.ru/vul/2025-08692 · Security Note
- https://ubuntu.com/security/notices/USN-7626-2 · Vendor Advisory
- https://ubuntu.com/security/CVE-2025-27613 · Vendor Advisory
- https://osv.dev/vulnerability/ALSA-2025:11462 · Vendor Advisory
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50349 · Security Note
- https://osv.dev/vulnerability/ALSA-2025:11534 · Vendor Advisory
- https://bdu.fstec.ru/vul/2025-01175 · Security Note
- https://osv.dev/vulnerability/USN-7626-2 · Vendor Advisory
- https://linux.oracle.com/errata/ELSA-2025-11688.html · Vendor Advisory
- https://osv.dev/vulnerability/ALSA-2025:11533 · Vendor Advisory
- https://security-tracker.debian.org/tracker/source-package/git · Vendor Advisory
- https://ubuntu.com/security/CVE-2025-27614 · Vendor Advisory
- https://linux.oracle.com/errata/ELSA-2025-11534.html · Vendor Advisory