CISA is warning of a worrying Git security flaw, so stay alert

News
By published

High-severity Git bug was added to KEV recently

Security
(Image credit: Shutterstock) (Image credit: Shutterstock)
  • CISA adds CVE-2025-48384 to its Known Exploited Vulnerabilities catalog
  • Git patched it in July 2025, but there are also mitigations and workarounds
  • Users should patch immediately, or face possible attack

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a serious Git vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning of in-the-wild abuse and giving Federal Civilian Executive Branch (FCEB) agencies three weeks to patch up.

The Git distributed version control system is a software development tool helping users keep track of code changes, allowing them to share it with others, and cooperate on different projects.

It was recently discovered that it had a bug where it handles special “carriage return” characters inconsistently - so when configuring submodules, this can trick Git into setting up a repository in the wrong place and then running hidden, attacker-supplied code.

Avoiding recursive submodule clones

The bug is tracked as CVE-2025-48384, and has a severity score of 8.0/10 (high). It was discovered in early July 2025, and fixed with a patch. Here is a list of patched up Git distributed version control system: 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

Git is extremely popular. It is the standard version control system used by developers worldwide, and platforms like GitHub, GitLab, and Bitbucket all run on Git. Furthermore, almost every major software project, including Linux, Android, Chrome, and VS Code, uses it to manage code.

When CISA adds a bug to KEV, it usually means it has observed it being used in real-life attacks. This flaw was added on July 25, 2025, meaning FCEB agencies have until September 15 to patch it up or stop using Git altogether. Usually, other government agencies, as well as companies in the private sector, keep track of KEV and apply the updates at the same time, as well.

Those that are unable to patch can deploy a mitigation in the form of avoiding recursive submodule clones from untrusted sources. Furthermore, users should disable Git hooks globally via core.hooksPath, and enforce only audited submodules.

Via BleepingComputer

You might also like

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.