Command Injection Vulnerability in Git Affects Multiple Versions
CVE-2025-48385

8.6HIGH

Key Information:

Vendor

Git

Status
Vendor
CVE Published:
8 July 2025

What is CVE-2025-48385?

A command injection vulnerability exists in Git, which arises when the Git client fails to adequately validate remote server advertisements for bundles during repository cloning. This weakness permits an adversary to potentially control the location where a bundle is written, risking the execution of arbitrary code. The issue primarily affects specifically crafted clone requests and can be circumvented by disabling recursive clones and adjusting configuration settings for bundle handling. Versions v2.43.7 and above contain fixes addressing this vulnerability, reinforcing the importance of using up-to-date software to mitigate risks.

Affected Version(s)

git < 2.43.7 < 2.43.7

git >= 2.44.0-rc0, < 2.44.4 < 2.44.0-rc0, 2.44.4

git >= 2.45.0-rc0, < 2.45.4 < 2.45.0-rc0, 2.45.4

References

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48385 : Command Injection Vulnerability in Git Affects Multiple Versions