CVE-2025-48384

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48384
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48384.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-48384
Aliases
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CLSA (10)
DEBIAN (1)
ECHO (1)
MINI (1)
OESA (6)
openSUSE (1)
RHSA (11)
RLSA (2)
ROOT (2)
SUSE (5)
UBUNTU (1)
Related
ALSA (3)
openSUSE (1)
SUSE (5)
Published
2025-07-08T18:23:48Z
Modified
2026-08-12T03:30:42Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Git allows arbitrary code execution through broken config quoting
Details

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-436",
        "CWE-59"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48384.json"
}
References

Affected packages

Git / github.com/git-for-windows/git

Affected ranges

Type
GIT
Repo
https://github.com/git-for-windows/git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9022eb323edaad8654d79b9d325d9429a53763d9
Fixed
4d32d83913170b86f9753fca10e75cdb2223d1cc
Introduced
cca1f38702730b35f52c29efd62864b85e85ddcc
Fixed
6cba5081d357807b9d132c68423ad561b7f153e2
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "2.47.0"
        },
        {
            "fixed":  "2.47.3"
        },
        {
            "introduced":  "2.50.0"
        },
        {
            "fixed":  "2.50.1"
        },
        {
            "introduced":  "2.49.0"
        },
        {
            "fixed":  "2.49.1"
        }
    ],
    "source":  "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/git/git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7a1903ad46b5cc7524c0734a5034dccaec07209b
Introduced
3c2a3fdc388747b9eaf4a4a4f2035c1c9ddb26d0
Fixed
080b728d4b2bbdd2c0b9eb9ed6a41195f8303088
Introduced
786a3e4b8d754d2b14b1208b98eeb0a554ef19a8
Fixed
f94b90ad6e49cc7f15c4171c5a434aa459e82d2d
Introduced
39bf06adf96da25b87c9aa7d35a32ef3683eb4a4
Fixed
47d3b506d48b7971080f09770f5b06b42569c967
Introduced
777489f9e09c8d0dd6b12f9d90de6376330577a2
Fixed
a52a24e03c8c711f1d5e252fba78f9276908129b
Introduced
fbe8d3079d4a96aeb4e4529cc93cc0043b759a05
Fixed
fbae1f06cbb04a6592c32f465e9bc28149039358
Introduced
683c54c999c301c2cd6f715c411407c413b1d84e
Fixed
aadf8ae518afd80b73d49eff8aff475161aa5157
Introduced
16bd9f20a403117f2e0d9bcda6c6e621d3763e77
Fixed
d82adb61ba2fd11d8f2587fca1b6bd7925ce4044
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.43.7"
        },
        {
            "introduced":  "2.44.0"
        },
        {
            "fixed":  "2.44.4"
        },
        {
            "introduced":  "2.45.0"
        },
        {
            "fixed":  "2.45.4"
        },
        {
            "introduced":  "2.46.0"
        },
        {
            "fixed":  "2.46.4"
        },
        {
            "introduced":  "2.47.0"
        },
        {
            "fixed":  "2.47.3"
        },
        {
            "introduced":  "2.48.0"
        },
        {
            "fixed":  "2.48.2"
        },
        {
            "introduced":  "2.49.0"
        },
        {
            "fixed":  "2.49.1"
        },
        {
            "introduced":  "2.50.0"
        },
        {
            "fixed":  "2.50.1"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

v0.*
v0.99
v0.99.1
v0.99.2
v0.99.3
v0.99.4
v0.99.5
v0.99.6
v0.99.7
v0.99.8
v0.99.8a
v0.99.8b
v0.99.8c
v0.99.8d
v0.99.8e
v0.99.8f
v0.99.8g
v0.99.9a
v0.99.9b
v0.99.9c
v0.99.9d
v0.99.9e
v0.99.9f
v0.99.9g
v0.99.9h
v0.99.9i
v0.99.9j
v0.99.9k
v0.99.9l
v0.99.9m
v0.99.9n
v1.*
v1.0.0
v1.0rc1
v1.0rc2
v1.0rc3
v1.0rc4
v1.0rc5
v1.0rc6
v1.1.0
v1.2.0
v1.3.0-rc1
v1.4.1
v1.4.1-rc1
v1.4.1-rc2
v1.4.2
v1.4.2-rc1
v1.4.2-rc2
v1.4.2-rc3
v1.4.2-rc4
v1.4.3
v1.4.3-rc1
v1.4.3-rc2
v1.4.3-rc3
v1.4.4
v1.4.4-rc1
v1.4.4-rc2
v1.4.4.1
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.5.0-rc4
v1.5.1
v1.5.1-rc1
v1.5.1-rc2
v1.5.1-rc3
v1.5.2
v1.5.2-rc0
v1.5.2-rc1
v1.5.2-rc2
v1.5.2-rc3
v1.5.3
v1.5.3-rc0
v1.5.3-rc1
v1.5.3-rc2
v1.5.3-rc3
v1.5.3-rc4
v1.5.3-rc5
v1.5.3-rc6
v1.5.3-rc7
v1.5.3.1
v1.5.4
v1.5.4-rc0
v1.5.4-rc1
v1.5.4-rc2
v1.5.4-rc3
v1.5.4-rc4
v1.5.4-rc5
v1.5.5
v1.5.5-rc0
v1.5.5-rc1
v1.5.5-rc2
v1.5.5-rc3
v1.5.6
v1.5.6-rc0
v1.5.6-rc1
v1.5.6-rc2
v1.5.6-rc3
v1.6.0
v1.6.0-rc0
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.6.1
v1.6.1-rc1
v1.6.1-rc2
v1.6.1-rc3
v1.6.1-rc4
v1.6.2
v1.6.2-rc0
v1.6.2-rc1
v1.6.2-rc2
v1.6.3
v1.6.3-rc0
v1.6.3-rc1
v1.6.3-rc2
v1.6.3-rc3
v1.6.3-rc4
v1.6.4
v1.6.4-rc0
v1.6.4-rc1
v1.6.4-rc2
v1.6.4-rc3
v1.6.5
v1.6.5-rc0
v1.6.5-rc1
v1.6.5-rc2
v1.6.5-rc3
v1.6.6
v1.6.6-rc0
v1.6.6-rc1
v1.6.6-rc2
v1.6.6-rc3
v1.6.6-rc4
v1.7.0
v1.7.0-rc0
v1.7.0-rc1
v1.7.0-rc2
v1.7.1
v1.7.1-rc0
v1.7.1-rc1
v1.7.1-rc2
v1.7.10
v1.7.10-rc0
v1.7.10-rc1
v1.7.10-rc2
v1.7.10-rc3
v1.7.10-rc4
v1.7.11
v1.7.11-rc0
v1.7.11-rc1
v1.7.11-rc2
v1.7.11-rc3
v1.7.12
v1.7.12-rc0
v1.7.12-rc1
v1.7.12-rc2
v1.7.12-rc3
v1.7.2
v1.7.2-rc0
v1.7.2-rc1
v1.7.2-rc2
v1.7.2-rc3
v1.7.3
v1.7.3-rc0
v1.7.3-rc1
v1.7.3-rc2
v1.7.3.1
v1.7.4
v1.7.4-rc0
v1.7.4-rc1
v1.7.4-rc2
v1.7.4-rc3
v1.7.5
v1.7.5-rc0
v1.7.5-rc1
v1.7.5-rc2
v1.7.5-rc3
v1.7.6
v1.7.6-rc0
v1.7.6-rc1
v1.7.6-rc2
v1.7.6-rc3
v1.7.7
v1.7.7-rc0
v1.7.7-rc1
v1.7.7-rc2
v1.7.7-rc3
v1.7.8
v1.7.8-rc0
v1.7.8-rc1
v1.7.8-rc2
v1.7.8-rc3
v1.7.8-rc4
v1.7.9
v1.7.9-rc0
v1.7.9-rc1
v1.7.9-rc2
v1.8.0
v1.8.0-rc0
v1.8.0-rc1
v1.8.0-rc2
v1.8.0-rc3
v1.8.1
v1.8.1-rc0
v1.8.1-rc1
v1.8.1-rc2
v1.8.1-rc3
v1.8.2
v1.8.2-rc0
v1.8.2-rc1
v1.8.2-rc2
v1.8.2-rc3
v1.8.3
v1.8.3-rc0
v1.8.3-rc1
v1.8.3-rc2
v1.8.3-rc3
v1.8.4
v1.8.4-rc0
v1.8.4-rc1
v1.8.4-rc2
v1.8.4-rc3
v1.8.4-rc4
v1.8.5
v1.8.5-rc0
v1.8.5-rc1
v1.8.5-rc2
v1.8.5-rc3
v1.9-rc0
v1.9-rc1
v1.9-rc2
v1.9.0
v1.9.0-rc3
v2.*
v2.0.0
v2.0.0-rc0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.0.0-rc4
v2.1.0
v2.1.0-rc0
v2.1.0-rc1
v2.1.0-rc2
v2.10.0
v2.10.0-rc0
v2.10.0-rc1
v2.10.0-rc2
v2.11.0
v2.11.0-rc0
v2.11.0-rc1
v2.11.0-rc2
v2.11.0-rc3
v2.12.0
v2.12.0-rc0
v2.12.0-rc1
v2.12.0-rc2
v2.13.0
v2.13.0-rc0
v2.13.0-rc1
v2.13.0-rc2
v2.14.0
v2.14.0-rc0
v2.14.0-rc1
v2.15.0
v2.15.0-rc0
v2.15.0-rc1
v2.15.0-rc2
v2.16.0
v2.16.0-rc0
v2.16.0-rc1
v2.16.0-rc2
v2.17.0
v2.17.0-rc0
v2.17.0-rc1
v2.17.0-rc2
v2.18.0
v2.18.0-rc0
v2.18.0-rc1
v2.18.0-rc2
v2.19.0
v2.19.0-rc0
v2.19.0-rc1
v2.19.0-rc2
v2.2.0
v2.2.0-rc0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.20.0
v2.20.0-rc0
v2.20.0-rc1
v2.20.0-rc2
v2.21.0
v2.21.0-rc0
v2.21.0-rc1
v2.21.0-rc2
v2.22.0
v2.22.0-rc0
v2.22.0-rc1
v2.22.0-rc2
v2.22.0-rc3
v2.23.0
v2.23.0-rc0
v2.23.0-rc1
v2.23.0-rc2
v2.24.0
v2.24.0-rc0
v2.24.0-rc1
v2.24.0-rc2
v2.25.0
v2.25.0-rc0
v2.25.0-rc1
v2.25.0-rc2
v2.26.0
v2.26.0-rc0
v2.26.0-rc1
v2.26.0-rc2
v2.27.0
v2.27.0-rc0
v2.27.0-rc1
v2.27.0-rc2
v2.28.0
v2.28.0-rc0
v2.28.0-rc1
v2.28.0-rc2
v2.29.0
v2.29.0-rc0
v2.29.0-rc1
v2.29.0-rc2
v2.3.0
v2.3.0-rc0
v2.3.0-rc1
v2.3.0-rc2
v2.30.0
v2.30.0-rc0
v2.30.0-rc1
v2.30.0-rc2
v2.31.0
v2.31.0-rc0
v2.31.0-rc1
v2.31.0-rc2
v2.32.0
v2.32.0-rc0
v2.32.0-rc1
v2.32.0-rc2
v2.32.0-rc3
v2.33.0
v2.33.0-rc0
v2.33.0-rc1
v2.33.0-rc2
v2.34.0
v2.34.0-rc0
v2.34.0-rc1
v2.34.0-rc2
v2.35.0
v2.35.0-rc0
v2.35.0-rc1
v2.35.0-rc2
v2.36.0
v2.36.0-rc0
v2.36.0-rc1
v2.36.0-rc2
v2.37.0
v2.37.0-rc0
v2.37.0-rc1
v2.37.0-rc2
v2.38.0
v2.38.0-rc0
v2.38.0-rc1
v2.38.0-rc2
v2.39.0
v2.39.0-rc0
v2.39.0-rc1
v2.39.0-rc2
v2.4.0
v2.4.0-rc0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.40.0
v2.40.0-rc0
v2.40.0-rc1
v2.40.0-rc2
v2.41.0
v2.41.0-rc0
v2.41.0-rc1
v2.41.0-rc2
v2.42.0
v2.42.0-rc0
v2.42.0-rc1
v2.42.0-rc2
v2.43.0
v2.43.0-rc0
v2.43.0-rc1
v2.43.0-rc2
v2.43.1
v2.43.2
v2.43.3
v2.43.4
v2.43.5
v2.43.6
v2.44.0
v2.44.1
v2.44.2
v2.44.3
v2.45.0
v2.45.1
v2.45.2
v2.45.3
v2.46.0
v2.46.1
v2.46.2
v2.46.3
v2.47.0
v2.47.1
v2.47.1.windows.1
v2.47.1.windows.2
v2.47.2
v2.48.0
v2.48.1
v2.49.0
v2.49.0.windows.1
v2.5.0
v2.5.0-rc0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.50.0
v2.50.0.windows.1
v2.50.0.windows.2
v2.6.0
v2.6.0-rc0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.7.0
v2.7.0-rc0
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.8.0
v2.8.0-rc0
v2.8.0-rc1
v2.8.0-rc2
v2.8.0-rc3
v2.8.0-rc4
v2.9.0
v2.9.0-rc0
v2.9.0-rc1
v2.9.0-rc2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48384.json"