Exploited vulnerabilitiesBriefPublic record
Git submodule CR/LF arbitrary write (CVE-2025-48384)
Disclosed 8 Jul 2025. `git clone --recursive` of a malicious repo leads to hook execution (macOS and Linux).
- Disclosed
What happened
- Fixed: Git 2.50.1 and backports (2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1). GitHub Desktop was also affected.
- KEV: 25 Aug 2025.
Live scores
Live scores
CVE-2025-48384- EPSS
- 0.044
some chance of attack soon - VEDAS
- 0.970
strong exploit evidence - On CISA KEV
- Yes, since 2025-08-25
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/
- https://nvd.nist.gov/vuln/detail/CVE-2025-48384
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.