Critical Vulnerability in Git Package: Path Manipulation and Execution Risk
Summary
CVE-2025-48384: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Affects git across 3 version ranges.
< 2.43.7-r0
< 7a1903ad46b5cc7524c0734a5034dccaec07209b
< 9022eb323edaad8654d79b9d325d9429a53763d9
Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a fast, scalable, distributed revision control system that allows users to manage and track changes in source code during software development. It features a rich command set that provides both high-level operations and full access to its internals. However, Git has a vulnerability that affects its handling of configuration values, particularly when dealing with trailing carriage returns in paths.
Vulnerability Detail
The vulnerability arises when Git reads a configuration value that contains a trailing carriage return (CR). When writing this config entry, the trailing CR is not quoted, leading to its loss upon subsequent reads. This issue becomes critical during submodule initialization, where a path with a trailing CR can result in the submodule being checked out to an incorrect location. If a symlink points to this altered path and the submodule contains an executable post-checkout hook, the script may be unintentionally executed, posing a significant security risk.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using paths with trailing carriage returns in their Git configurations. Additionally, ensure that any symlinks do not point to altered paths that could lead to the execution of unintended scripts.
Conclusion
The vulnerability in Git related to the handling of trailing carriage returns poses a significant risk, particularly in submodule management. Users are strongly advised to update to the latest patched versions to mitigate this risk. Monitoring tools like Vulert can assist in identifying such vulnerabilities in real-time.
See every vulnerability recorded for git →
FAQ
The vulnerability involves improper handling of trailing carriage returns in configuration values, which can lead to incorrect submodule paths and potential execution of unintended scripts.
You can check your Git version by running 'git --version' in your terminal. If it is older than the patched versions listed, it is vulnerable.
The primary risk is that an executable script in a submodule may be unintentionally executed, which could lead to unauthorized actions or data breaches.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file. You can check your application for vulnerabilities without any signup at the Vulert playground.
If immediate updates are not possible, avoid using paths with trailing carriage returns and ensure symlinks do not point to altered paths.
Related vulnerabilities
Recent vulnerabilities recorded for git.
