Critical Protocol Injection Vulnerability in Git Package
Summary
ALPINE-CVE-2025-48385: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Affects git versions < 2.43.7-r0. Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a fast, scalable, distributed revision control system that allows users to manage and track changes in source code during software development. It features a rich command set that provides both high-level operations and full access to its internals. However, Git has a vulnerability that allows for protocol injection when cloning repositories, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from Git's insufficient validation of advertised bundles when cloning a repository. This flaw allows a remote server to perform protocol injection, potentially causing the Git client to write fetched bundles to a location controlled by an adversary. The consequences can be dire, including arbitrary code execution, especially if the adversary can manipulate the repository's cloning location. This vulnerability is particularly concerning as it can be exploited through social engineering or recursive clones with submodules.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable recursive clones to mitigate the risk of exploitation. This can be done by avoiding the use of the --recursive flag when cloning repositories.
Conclusion
The Git protocol injection vulnerability poses a significant risk to users by allowing remote servers to manipulate the Git client's behavior. It is crucial to update to the patched versions of Git to mitigate this risk. Additionally, employing workarounds such as disabling recursive clones can provide temporary relief until updates are applied.
See every vulnerability recorded for git →
FAQ
The vulnerability is a protocol injection flaw that allows remote servers to manipulate where the Git client writes fetched bundles.
Check the version of Git you are using. If it is below the patched versions (2.43.7, 2.44.4, etc.), it is vulnerable.
Exploitation of this vulnerability can lead to arbitrary code execution on the client machine, posing significant security risks.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
