CVE-2025-48384 — Git allows arbitrary code execution through broken config quoting

Description

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Affected products

Vendor	Product	Affected	Fixed
git	git	< 2.43.7, >= 2.44.0-rc0, < 2.44.4, >= 2.45.0-rc0, < 2.45.4, >= 2.46.0-rc0, < 2.46.4, >= 2.47.0-rc0, < 2.47.3, >= 2.48.0-rc0, < 2.48.2, >= 2.49.0-rc0, < 2.49.1, >= 2.50.0-rc0, < 2.50.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	git	1:2.50.1-0.1	—
Debian 13	git	1:2.47.3-0+deb13u1	—
Debian 12	git	1:2.39.5-0+deb12u3	—
Debian 11	git	1:2.30.2-1+deb11u5	DLA-4323-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	git	1:2.43.0-1ubuntu7.3	USN-7626-1
Ubuntu 22.04 LTS	git	1:2.34.1-1ubuntu1.13	USN-7626-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 20.04 LTS	git	1:2.25.1-1ubuntu3.14+esm1	USN-7626-1
Ubuntu Pro 18.04 LTS	git	1:2.17.1-1ubuntu0.18+esm2	USN-7626-1
Ubuntu Pro 16.04 LTS	git	1:2.7.4-0ubuntu1.10+esm9	USN-7626-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	git +14	2.47.3-1.el10_0	RHSA-2025:11533
RHEL 9	git +14	2.47.3-1.el9_6	RHSA-2025:11462
RHEL 8	git +14	2.43.7-1.el8_10	RHSA-2025:11534

Show 12 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.4 EUS	git +14	2.43.5-1.el9_4.2	RHSA-2025:11686
RHEL 9.2 E4S	git +14	2.39.5-1.el9_2.2	RHSA-2025:11795
RHEL 9.0 E4S	git +14	2.31.1-6.el9_0.1	RHSA-2025:11796
RHEL 8.8 TUS	git +14	2.39.5-1.el8_8.2	RHSA-2025:11794
RHEL 8.8 E4S	git +14	2.39.5-1.el8_8.2	RHSA-2025:11794
RHEL 8.6 TUS	git +14	2.31.8-3.el8_6.1	RHSA-2025:11801
RHEL 8.6 E4S	git +14	2.31.8-3.el8_6.1	RHSA-2025:11801
RHEL 8.6 AUS	git +14	2.31.8-3.el8_6.1	RHSA-2025:11801
RHEL 8.4 EUS Long Life	git +14	2.27.0-5.el8_4.1	RHSA-2025:11800
RHEL 8.4 AUS	git +14	2.27.0-5.el8_4.1	RHSA-2025:11800
RHEL 8.2 AUS	git +13	2.18.4-5.el8_2.1	RHSA-2025:11793
RHEL 7 ELS	git +17	1.8.3.1-25.el7_9.1	RHSA-2025:11688

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	gitk +10	2.47.3-1.el10_0	ALSA-2025:11533
AlmaLinux 9	git +14	2.47.3-1.el9_6	ALSA-2025:11462
AlmaLinux 8	git +14	2.43.7-1.el8_10	ALSA-2025:11534

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	git	2.47.3-1.el9_6	RLSA-2025:11462
Rocky Linux 8	git	2.43.7-1.el8_10	RLSA-2025:11534

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	git	2.51.0-150600.3.12.1	SUSE-SU-2025:03012-1
SLES 15 SP7	git-lfs	3.7.0-150600.13.3.1	SUSE-SU-2025:03012-1
SLES 15 SP7	obs-scm-bridge	0.7.4-150600.14.4.1	SUSE-SU-2025:03012-1
SLES 15 SP6	git	2.51.0-150600.3.12.1	SUSE-SU-2025:03012-1
SLES 15 SP6	git-lfs	3.7.0-150600.13.3.1	SUSE-SU-2025:03012-1
SLES 15 SP6	obs-scm-bridge	0.7.4-150600.14.4.1	SUSE-SU-2025:03012-1
SLES 15 SP5	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SLES 15 SP4	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SLES 15 SP3	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1

Show 14 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	git	2.26.2-27.81.1	SUSE-SU-2025:03022-1
SLES 3	python-PyYAML	6.0.2-150600.10.3.1	SUSE-SU-2025:03012-1
SLES for SAP 15 SP5	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SLES for SAP 15 SP4	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SLES for SAP 15 SP3	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SLE Micro 6.1	git	2.51.0-slfo.1.1_1.1	SUSE-SU-2025:20855-1
SLE Micro 6.0	git	2.51.0-1.1	SUSE-SU-2025:20721-1
SLE Micro 5.5	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SLE HPC 15 SP5	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SLE HPC 15 SP4	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SLE HPC 15 SP3	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SUSE Manager Server LTS 4.3	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SUSE Manager Proxy LTS 4.3	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1
SUSE Enterprise Storage 7.1	git	2.43.7-150300.10.51.1	SUSE-SU-2025:03037-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	git	2.50.1-1.1	openSUSE-SU-2025:15337-1
openSUSE Leap 15.6	git	2.51.0-150600.3.12.1	SUSE-SU-2025:03012-1
openSUSE Leap 15.6	git-lfs	3.7.0-150600.13.3.1	SUSE-SU-2025:03012-1
openSUSE Leap 15.6	obs-scm-bridge	0.7.4-150600.14.4.1	SUSE-SU-2025:03012-1
openSUSE Leap 15.6	python-PyYAML	6.0.2-150600.10.3.1	SUSE-SU-2025:03012-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	git	2.50.1-r0	—
Alpine v3.23	git	2.50.1-r0	—
Alpine v3.22	git	2.49.1-r0	—
Alpine v3.21	git	2.47.3-r0	—
Alpine v3.20	git	2.45.4-r0	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	git	2.43.7-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	git +16	2.50.1-1.amzn2023.0.1	ALAS2023-2025-1108
Amazon Linux 2	git +16	2.47.3-1.amzn2.0.1	ALAS2-2025-2941

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	git	2.45.4-1	—
Azure Linux 2 (CBL-Mariner)	git	2.40.4-2	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	git +14	2.47.3-1.el10_0	ELSA-2025-11533
Oracle Linux 9	git +14	2.47.3-1.el9_6	ELSA-2025-11462
Oracle Linux 8	git +14	2.43.7-1.el8_10	ELSA-2025-11534
Oracle Linux 7	git +17	1.8.3.1-25.0.1.el7_9	ELSA-2025-11688

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 43 repositories · most starred shown

acheong08/CVE-2025-48384 ★ 53 · Jul 8, 2025

Breaking git with a carriage return and cloning RCE
liamg/CVE-2025-48384 ★ 22 · Jul 9, 2025

PoC for CVE-2025-48384
zr0n/CVE-2025-48384-sub ★ 3 · Dec 4, 2025
zr0n/CVE-2025-48384-main ★ 2 · Dec 4, 2025

A proof of concept of remote code execution
beishanxueyuan/CVE-2025-48384-test ★ 1 · Aug 4, 2025
IK-20211125/CVE-2025-48384 ★ 1 · Jul 20, 2025

CVE-2025-48384 PoC
vinieger/vinieger-CVE-2025-48384-Dockerfile ★ 1 · Jul 11, 2025

PoC dockerfile image for CVE-2025-48384
fishyyh/CVE-2025-48384 ★ 0 · Jul 9, 2025

for CVE-2025-48384 test
fishyyh/CVE-2025-48384-POC ★ 0 · Jul 9, 2025
kallydev/cve-2025-48384-hook ★ 0 · Jul 9, 2025

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 34

ALSA-2025:11462 Important: git security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:11533 Important: git security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:11534 Important: git security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2025:11534 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:11462 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:11533 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:11801 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:11796 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:11800 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:11794 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:11795 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:11688 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:11793 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:11686 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
USN-7626-1 git vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
SUSE-SU-2025:20721-1 Security update for git SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:20855-1 Security update for git SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:03037-1 Security update for git SUSE / openSUSE Security Updates · Mar 23, 2026
WID-SEC-2025-1905 IBM QRadar SIEM Komponente: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 4, 2026
SUSE-SU-2025:03022-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2025:03012-1 security update for git, git-lfs, obs-scm-bridge, python-PyYAML SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:15337-1 git-2.50.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2025-1485 Microsoft Developer Tools und git: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 26, 2025
RLSA-2025:11462 Important: git security update Rocky Linux Security Advisories · Oct 7, 2025
DLA-4323-1 git - security update Debian Security (DSA / DLA) · Oct 6, 2025
WID-SEC-2025-2059 Apple Xcode: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 15, 2025
ELSA-2025-11688 Important: git security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 12, 2025
ALAS2023-2025-1108 Important: git security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 8, 2025
ALAS2-2025-2941 Important: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 30, 2025
RLSA-2025:11534 Important: git security update Rocky Linux Security Advisories · Jul 29, 2025
ELSA-2025-11534 Important: git security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 22, 2025
ELSA-2025-11533 Important: git security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 22, 2025
ELSA-2025-11462 Important: git security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 21, 2025
NCSC-2025-0217 Kwetsbaarheden verholpen in Microsoft Visual Studio NCSC-NL (Netherlands) · Jul 8, 2025

References

https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9

CNA	v3.1	8.1
EUVD	v3.1	8.1