Git Config CR Submodule Path Hook Execution
- Product
- Git Git
- CVE
- CVE-2025-48384
- Disclosed
- 2025-07-08
- CVSS
- 8.1
- Auth
- requires auth / interaction
- CISA KEV
- yes
- Affected
- Git < 2.43.7, 2.44.x < 2.44.4, 2.45.x < 2.45.4, 2.46.x < 2.46.4, 2.47.x < 2.47.3, 2.48.x < 2.48.2, 2.49.x < 2.49.1, 2.50.0
- Fixed
- 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, 2.50.1
Summary
A carriage-return mismatch between how Git writes and reads config values let a malicious repository redirect a submodule checkout into the hooks directory. Recursive clones on Linux and macOS could then run an attacker hook. CISA added it to KEV in August 2025.
Root cause
Git strips a trailing CR when reading config values but did not quote values with a trailing CR when writing them. A submodule path ending in CR is therefore read back without it, so the submodule is checked out to a different path; if a symlink points that path to .git/modules/<name>/hooks, the submodule's executable post-checkout hook runs after checkout.
Impact
Arbitrary code execution when cloning an untrusted repository with submodules.
Detection
Inventory Git versions on developer machines and CI runners; scan .gitmodules for paths ending in a carriage return.
Mitigation
Upgrade Git to a fixed version and avoid recursive clones of untrusted repositories.