CVE-2025-48384 is regarding a vulnerability in Git where when reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. GitHub created this CVE on their behalf. The documented Visual Studio updates incorporate updates in Git which address this vulnerability.
\nPlease see CVE-2025-48384 for more information.
\n", "title": "microsoft - https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Jul" }, { "category": "description", "text": "Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.\nApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "title": "cisagov - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "category": "description", "text": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-48384" }, { "category": "description", "text": "This update for git fixes the following issues:\n\nUpdate to 2.51.0:\n\n- CVE-2025-27613: arbitrary writable file creation and truncation in Gitk (bsc#1245938)\n- CVE-2025-27614: arbitrary script execution via repo clonation in gitk (bsc#1245939)\n- CVE-2025-46835: untrusted repository cloning can lead to arbitrary writable file creation in Git GUI (bsc#1245942)\n- CVE-2025-48384: script may be unintentionally executed after checkout due to CRLF transforming (bsc#1245943)\n- CVE-2025-48385: arbitrary code execution due to protocol injection via fetching advertised bundle (bsc#1245946)\n- CVE-2025-48386: buffer overflow in static buffer 'target' in wincred credential helper (bsc#1245947)\n", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2025:20855-1.json?alt=media" }, { "category": "description", "text": "This update for git fixes the following issues:\n\nUpdated to 2.43.7 (jsc#PED-13447):\n\n- CVE-2025-27613: Fixed arbitrary writable file creation and truncation in Gitk (bsc#1245938)\n- CVE-2025-27614: Fixed arbitrary script execution via repo clonation in Gitk (bsc#1245939)\n- CVE-2025-46835: Fixed arbitrary writable file creation via untrusted repository clonation in Git GUI (bsc#1245942)\n- CVE-2025-48384: Fixed arbitrary writable file creation when cloning untrusted repositories with submodules\n using the --recursive flag (bsc#1245943)\n- CVE-2025-48385: Fixed arbitrary code execution due to protocol injection via fetching advertised bundle (bsc#1245946)\n\nOther fixes:\n\n- Drop git-credential-gnome-keyring package as it was dropped upstream,\n use git-credential-libsecret instead\n- git-add--interactive was removed upstream in favor of built in implementation,\n which was already the default in SLE.\n", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2025:03037-1.json?alt=media" }, { "category": "description", "text": "This update for git fixes the following issues:\n\n- Update to 2.51.0\n \n - UI, Workflows & Features\n - Userdiff patterns for the R language have been added.\n - Documentation for \"git send-email\" has been updated with a\n bit more credential helper and OAuth information.\n - \"git cat-file --batch\" learns to understand %(objectmode)\n atom to allow the caller to tell missing objects (due to\n repository corruption) and submodules (whose commit objects\n are OK to be missing) apart.\n - \"git diff --no-index dirA dirB\" can limit the comparison with\n pathspec at the end of the command line, just like normal\n \"git diff\".\n - \"git subtree\" (in contrib/) learned to grok GPG signing its\n commits.\n - \"git whatchanged\" that is longer to type than \"git log --raw\"\n which is its modern rough equivalent has outlived its\n usefulness more than 10 years ago. Plan to deprecate and\n remove it.\n - An interchange format for stash entries is defined, and\n subcommand of \"git stash\" to import/export has been added.\n - \"git merge/pull\" has been taught the \"--compact-summary\"\n option to use the compact-summary format, intead of diffstat,\n when showing the summary of the incoming changes.\n - \"git imap-send\" has been broken for a long time, which has\n been resurrected and then taught to talk OAuth2.0 etc.\n - Some error messages from \"git imap-send\" has been updated.\n - When \"git daemon\" sees a signal while attempting to accept()\n a new client, instead of retrying, it skipped it by mistake,\n which has been corrected.\n - The reftable ref backend has matured enough; Git 3.0 will\n make it the default format in a newly created repositories by\n default.\n - \"netrc\" credential helper has been improved to understand\n textual service names (like smtp) in addition to the numeric\n port numbers (like 25).\n - Lift the limitation to use changed-path filter in \"git log\"\n so that it can be used for a pathspec with multiple literal\n paths.\n - Clean up the way how signature on commit objects are exported\n to and imported from fast-import stream.\n - Remove unsupported, unused, and unsupportable old option from\n \"git log\".\n - Document recently added \"git imap-send --list\" with an\n example.\n - \"git pull\" learned to pay attention to pull.autostash\n configuration variable, which overrides\n rebase/merge.autostash.\n - \"git for-each-ref\" learns \"--start-after\" option to help\n applications that want to page its output.\n - \"git switch\" and \"git restore\" are declared to be no longer\n experimental.\n - \"git -c alias.foo=bar foo -h baz\" reported \"'foo' is aliased\n to 'bar'\" and then went on to run \"git foo -h baz\", which was\n unexpected. Tighten the rule so that alias expansion is\n reported only when \"-h\" is the sole option.\n - Performance, Internal Implementation, Development Support etc.\n - \"git pack-objects\" learned to find delta bases from blobs at\n the same path, using the --path-walk API.\n - CodingGuidelines update.\n - Add settings for Solaris 10 & 11.\n - Meson-based build/test framework now understands TAP output\n generated by our tests.\n - \"Do not explicitly initialize to zero\" rule has been\n clarified in the CodingGuidelines document.\n - A test helper \"test_seq\" function learned the \"-f