Evidence dossier

CVE-2025-48384

Git allows arbitrary code execution through broken config quoting

63.3–78.3Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

State: PUBLISHED
Published: Jul 8, 2025
Updated: Feb 26, 2026
Evidence coverage: 85%

CISA KEVCatalog member

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

FIRST EPSS2.77%

2026-07-18 · v2026.06.15 · percentile 84.7%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

CVEderivative copy

container

CVE Program Container

Jul 19, 2026Original evidence ↗

GitHub_Moriginal assertion

container

Git allows arbitrary code execution through broken config quoting

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

Git Link Following Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.027750000000; percentile 0.847450000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

gitgit

[{"status": "affected", "version": "< 2.43.7"}, {"status": "affected", "version": ">= 2.44.0-rc0, < 2.44.4"}, {"status": "affected", "version": ">= 2.45.0-rc0, < 2.45.4"}, {"status": "affected", "version": ">= 2.46.0-rc0, < 2.46.4"}, {"status": "affected", "version": ">= 2.47.0-rc0, < 2.47.3"}, {"status": "affected", "version": ">= 2.48.0-rc0, < 2.48.2"}, {"status": "affected", "version": ">= 2.49.0-rc0, < 2.49.1"}, {"status": "affected", "version": ">= 2.50.0-rc0, < 2.50.1"}]

unknown