CVE-2025-48384 Information

Jul 09, 2025 cve

Description

Git is a fast scalable distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value Git strips any trailing carriage return and line feed (CRLF). When writing a config entry values with a trailing CR are not quoted causing the CR to be lost when the config is later read. When initializing a submodule if the submodule path contains a trailing CR the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory and the submodule contains an executable post-checkout hook the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7 v2.44.4 v2.45.4 v2.46.4 v2.47.3 v2.48.2 v2.49.1 and v2.50.1.

Reference

https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9

CNNVD-202507-1041 (Published: 2025-07-08)

Share on: