Command Injection Vulnerability in Git Affects Multiple Versions
CVE-2025-48385
What is CVE-2025-48385?
A command injection vulnerability exists in Git, which arises when the Git client fails to adequately validate remote server advertisements for bundles during repository cloning. This weakness permits an adversary to potentially control the location where a bundle is written, risking the execution of arbitrary code. The issue primarily affects specifically crafted clone requests and can be circumvented by disabling recursive clones and adjusting configuration settings for bundle handling. Versions v2.43.7 and above contain fixes addressing this vulnerability, reinforcing the importance of using up-to-date software to mitigate risks.
Affected Version(s)
git < 2.43.7 < 2.43.7
git >= 2.44.0-rc0, < 2.44.4 < 2.44.0-rc0, 2.44.4
git >= 2.45.0-rc0, < 2.45.4 < 2.45.0-rc0, 2.45.4