CISA is warning of a worrying Git security flaw, so stay alert

CISA adds CVE-2025-48384 to its Known Exploited Vulnerabilities catalog
Git patched it in July 2025, but there are also mitigations and workarounds
Users should patch immediately, or face possible attack

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a serious Git vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning of in-the-wild abuse and giving Federal Civilian Executive Branch (FCEB) agencies three weeks to patch up.

The Git distributed version control system is a software development tool helping users keep track of code changes, allowing them to share it with others, and cooperate on different projects.

It was recently discovered that it had a bug where it handles special “carriage return” characters inconsistently – so when configuring submodules, this can trick Git into setting up a repository in the wrong place and then running hidden, attacker-supplied code.

Avoiding recursive submodule clones

The bug is tracked as CVE-2025-48384, and has a severity score of 8.0/10 (high). It was discovered in early July 2025, and fixed with a patch. Here is a list of patched up Git distributed version control system: 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

Git is extremely popular. It is the standard version control system used by developers worldwide, and platforms like GitHub, GitLab, and Bitbucket all run on Git. Furthermore, almost every major software project, including Linux, Android, Chrome, and VS Code, uses it to manage code.

When CISA adds a bug to KEV, it usually means it has observed it being used in real-life attacks. This flaw was added on July 25, 2025, meaning FCEB agencies have until September 15 to patch it up or stop using Git altogether. Usually, other government agencies, as well as companies in the private sector, keep track of KEV and apply the updates at the same time, as well.

Those that are unable to patch can deploy a mitigation in the form of avoiding recursive submodule clones from untrusted sources. Furthermore, users should disable Git hooks globally via core.hooksPath, and enforce only audited submodules.