Code Execution Risk in Git Due to Submodule Path Handling

CVE-2025-48384

What is CVE-2025-48384?

CVE-2025-48384 is a code execution vulnerability in Git, a widely used distributed version control system essential for managing source code in software development. This vulnerability arises from the way Git handles configuration values, particularly in relation to submodule paths. When Git processes configuration, it inadvertently strips trailing carriage return and line feed characters, leading to the potential alteration of specified submodule paths. If a path containing a trailing carriage return is incorrectly read, it can result in the submodule being initialized in an unintended location. This situation creates a security risk where, if a symlink to the altered path exists and the submodule has an executable post-checkout hook, that script could potentially run without explicit user consent. The implications of such unintended execution can severely compromise the integrity of systems utilizing Git, as malicious code could be executed within the context of the user's environment.

Potential impact of CVE-2025-48384

1. Unauthorized Code Execution: The primary risk associated with CVE-2025-48384 is the potential for unauthorized execution of arbitrary code. Malicious actors could manipulate submodule paths, leading to executable code launching without user knowledge, which could compromise the security of development environments and production systems.

2. Supply Chain Compromise: By exploiting this vulnerability, attackers can insert malicious code into legitimate projects through submodules, effectively posing a threat to the integrity of the software supply chain. This could result in the distribution of compromised software to broader user bases, amplifying the vulnerability's impact.

3. Operational Disruption: The execution of unintended scripts may disrupt normal operations, leading to downtime or unexpected behavior in software applications. Such disruptions can hinder development workflows and impact the stability of applications, causing financial and reputational damage to organizations.

News Articles

Arctic Wolf

CVE-2025-48384

PoC Available for High-Severity Arbitrary File Write in Git CLI I Arctic Wolf

On 8 July, 2025, the Git project released new versions of Git to address CVE-2025-48384, a high-severity vulnerability allowing threat actors to create malicious git repositories that unexpectedly run code when being cloned.

1 month ago

Arctic Wolf

CVE-2025-48384

PoC Available for High-Severity Arbitrary File Write in Git CLI I Arctic Wolf

On July 8, 2025, the Git project released new versions of Git to address CVE-2025-48384, a high-severity vulnerability allowing threat actors to create malicious git repositories that unexpectedly run code when being cloned.

1 month ago

References