Read the docs
TI-2025-30709 Aliases CVE-2025-48384

Git allows arbitrary code execution through broken config quoting

Priority CRITICAL 94Exploited in the wildCWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 27 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Why it matters now

Exploitation Active In CISA KEV since 2025-08-25CISA due date 2025-09-15
EPSS 0.04379 91st percentileScored 2026-11-07
Fix Partial git (git): 2.43.7, 2.44.4, 2.45.4 +5Red Hat: 21 advisoriesRed Hat: 27 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gitgitbefore 2.43.7; 2.44.0-rc0 to before 2.44.4; 2.45.0-rc0 to before 2.45.4; 2.46.0-rc0 to before 2.46.4; 2.47.0-rc0 to before 2.47.3; 2.48.0-rc0 to before 2.48.2; 2.49.0-rc0 to before 2.49.1; 2.50.0-rc0 to before 2.50.12.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1Patch availableCNA
  • git VendorGit Affected before 2.43.7; 2.44.0-rc0 to before 2.44.4; 2.45.0-rc0 to before 2.45.4; 2.46.0-rc0 to before 2.46.4; 2.47.0-rc0 to before 2.47.3; 2.48.0-rc0 to before 2.48.2; 2.49.0-rc0 to before 2.49.1; 2.50.0-rc0 to before 2.50.1 Fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*before 2.43.7; 2.44.0 to before 2.44.4; 2.45.0 to before 2.45.4; 2.46.0 to before 2.46.4; 2.47.0 to before 2.47.3; 2.48.0 to before 2.48.2; 2.49.0 to before 2.49.1; 2.50.0 to before 2.50.1VulnerableGit-scm
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*before 26.0VulnerableApple
  • cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* Versions before 2.43.7; 2.44.0 to before 2.44.4; 2.45.0 to before 2.45.4; 2.46.0 to before 2.46.4; 2.47.0 to before 2.47.3; 2.48.0 to before 2.48.2; 2.49.0 to before 2.49.1; 2.50.0 to before 2.50.1 Vulnerable ·Git-scm
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:* Versions before 26.0 Vulnerable ·Apple

Remediation

  • Fix · CNA git (git) Fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1

Red Hat 21 advisories

  • RHSA-2025:15672 Released 2025-09-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202509030117-0
  • RHSA-2025:15828 Released 2025-09-15 · Red Hat rating Important
    updated web-terminal/tooling container image
    • Red Hat Web Terminal 1.11 on RHEL 9 web-terminal/web-terminal-rhel9-operator, web-terminal/web-terminal-tooling-rhel9
  • RHSA-2025:15827 Released 2025-09-15 · Red Hat rating Important
    updated web-terminal/tooling container image
    • Red Hat Web Terminal 1.12 on RHEL 9 web-terminal/web-terminal-tooling-rhel9
Show 18 more Red Hat advisories
  • RHSA-2025:15308 Released 2025-09-11 · Red Hat rating Important
    OpenShift Container Platform 4.12.80 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202509030110-0
  • RHSA-2025:14858 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.16.47 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202508261955-0, rhcos-ppc64le-416.94.202508261955-0, rhcos-s390x-416.94.202508261955-0 +1
  • RHSA-2025:14853 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.14.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202508270040-0, rhcos-ppc64le-414.92.202508270040-0, rhcos-s390x-414.92.202508270040-0 +1
  • RHSA-2025:14396 Released 2025-08-27 · Red Hat rating Important
    OpenShift Container Platform 4.15.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202508192014-0, rhcos-ppc64le-415.92.202508192014-0, rhcos-s390x-415.92.202508192014-0 +1
  • RHSA-2025:14059 Released 2025-08-27 · Red Hat rating Important
    OpenShift Container Platform 4.17.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202508141510-0, rhcos-ppc64le-417.94.202508141510-0, rhcos-s390x-417.94.202508141510-0 +1
  • RHSA-2025:13933 Released 2025-08-20 · Red Hat rating Important
    OpenShift Container Platform 4.19.9 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202508112354-0, rhcos-ppc64le-4.19.9.6.202508112354-0, rhcos-s390x-4.19.9.6.202508112354-0 +1
  • RHSA-2025:13276 Released 2025-08-07 · Red Hat rating Important
    updated RHEL-8 based Middleware Containers container images
    • Middleware Containers for OpenShift rhpam-7/rhpam-businesscentral-monitoring-rhel8, rhpam-7/rhpam-businesscentral-rhel8, rhpam-7/rhpam-controller-rhel8 +6
  • RHSA-2025:11801 Released 2025-07-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) git-2.31.8-3.el8_6.1, git-all-2.31.8-3.el8_6.1, git-core-2.31.8-3.el8_6.1 +12
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) git-2.31.8-3.el8_6.1, git-all-2.31.8-3.el8_6.1, git-core-2.31.8-3.el8_6.1 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) git-2.31.8-3.el8_6.1, git-all-2.31.8-3.el8_6.1, git-core-2.31.8-3.el8_6.1 +12
  • RHSA-2025:11794 Released 2025-07-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) git-2.39.5-1.el8_8.2, git-all-2.39.5-1.el8_8.2, git-core-2.39.5-1.el8_8.2 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) git-2.39.5-1.el8_8.2, git-all-2.39.5-1.el8_8.2, git-core-2.39.5-1.el8_8.2 +12
  • RHSA-2025:11800 Released 2025-07-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) git-2.27.0-5.el8_4.1, git-all-2.27.0-5.el8_4.1, git-core-2.27.0-5.el8_4.1 +12
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) git-2.27.0-5.el8_4.1, git-all-2.27.0-5.el8_4.1, git-core-2.27.0-5.el8_4.1 +12
  • RHSA-2025:11796 Released 2025-07-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) git-2.31.1-6.el9_0.1, git-all-2.31.1-6.el9_0.1, git-core-2.31.1-6.el9_0.1 +12
  • RHSA-2025:11795 Released 2025-07-28 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) git-2.39.5-1.el9_2.2, git-all-2.39.5-1.el9_2.2, git-core-2.39.5-1.el9_2.2 +12
  • RHSA-2025:11793 Released 2025-07-24 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) git-2.18.4-5.el8_2.1, git-all-2.18.4-5.el8_2.1, git-core-2.18.4-5.el8_2.1 +11
  • RHSA-2025:11688 Released 2025-07-24 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) git-1.8.3.1-25.el7_9.1, perl-Git-1.8.3.1-25.el7_9.1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) emacs-git-1.8.3.1-25.el7_9.1, emacs-git-el-1.8.3.1-25.el7_9.1, git-all-1.8.3.1-25.el7_9.1 +13
  • RHSA-2025:11686 Released 2025-07-24 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) git-2.43.5-1.el9_4.2, git-all-2.43.5-1.el9_4.2, git-core-2.43.5-1.el9_4.2 +12
  • RHSA-2025:11534 Released 2025-07-23 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-2.43.7-1.el8_10, git-all-2.43.7-1.el8_10, git-core-2.43.7-1.el8_10 +12
  • RHSA-2025:11533 Released 2025-07-22 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 10) git-2.47.3-1.el10_0, git-all-2.47.3-1.el10_0, git-core-2.47.3-1.el10_0 +12
  • RHSA-2025:11462 Released 2025-07-21 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 9) git-2.47.3-1.el9_6, git-all-2.47.3-1.el9_6, git-core-2.47.3-1.el9_6 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Middleware Containers for OpenShiftFixed RHSA-2025:13276
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:11533
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:11534
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:11462
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:11793
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:11800
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:11801
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:11801
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:11794
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:11796
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:11795
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:11686
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2025:11800
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:11801
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:11794
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:11688
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:11688
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:15308
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:15672
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:14853
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:14396
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:14858
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:14059
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:13325
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:13933
Red Hat Web Terminal 1.11 on RHEL 9Fixed RHSA-2025:15828
Red Hat Web Terminal 1.12 on RHEL 9Fixed RHSA-2025:15827
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2025-08-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-48384
  3. 2026-10-13 Affected versions changed · Red Hat

References

Advisory 3

  • TI-2022-07580 gitattributes parsing integer overflow in git CVSS 3.1CRITICAL 9.8
  • TI-2022-20244 Integer overflow in `git archive`, `git log --format` leading to RCE in git CVSS 3.1CRITICAL 9.8
  • TI-2021-04400 malicious repositories can execute remote code while cloning CVSS 3.1HIGH 8.0
  • TI-2024-21101 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVSS 3.1CRITICAL 9.1
  • TI-2023-10933 "git apply --reject" partially-controlled arbitrary file write CVSS 3.1HIGH 7.5
  • TI-2024-21116 Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory CVSS 3.1HIGH 7.1
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences