Command Injection Vulnerability in Git Affects Multiple Versions
CVE-2025-48385
Key Information:
Badges
What is CVE-2025-48385?
A command injection vulnerability exists in Git, which arises when the Git client fails to adequately validate remote server advertisements for bundles during repository cloning. This weakness permits an adversary to potentially control the location where a bundle is written, risking the execution of arbitrary code. The issue primarily affects specifically crafted clone requests and can be circumvented by disabling recursive clones and adjusting configuration settings for bundle handling. Versions v2.43.7 and above contain fixes addressing this vulnerability, reinforcing the importance of using up-to-date software to mitigate risks.
Affected Version(s)
git < 2.43.7 < 2.43.7
git >= 2.44.0-rc0, < 2.44.4 < 2.44.0-rc0, 2.44.4
git >= 2.45.0-rc0, < 2.45.4 < 2.45.0-rc0, 2.45.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.