Corrective releases of the distributed version control system Git 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1 have been published, which address vulnerabilities that allow executing one's code on the user's system when cloning a repository controlled by an attacker.
- CVE-2025-48384 — the vulnerability is caused by Git clearing the specified newline (LF) and carriage return (CR) characters at the end when reading configuration parameter values, but not escaping the carriage return character when writing values to the configuration file. An attacker can specify a path upon initializing a submodule that ends with a carriage return character (file systems in Unix-like OSs allow specifying special characters in filenames and directories).
Clearing the carriage return character when reading the configuration will result in the submodule being extracted to an incorrect path. An attacker can place a symbolic link at this incorrect path pointing to a directory with git hooks and place a handler in it that will be invoked after the checkout operation is completed. Executing the 'git clone --recursive' command on a repository with such a submodule will lead to the execution of the code specified by the malicious actor.
- CVE-2025-48385 — insufficient client-side verification of bundle files served proxy server during the cloning of the repository and used for transmitting part of the data served through content delivery systems (CDN). An attacker controlling the Git server can arrange for the client to download a specially crafted bundle file, which, once extracted, will be saved in an arbitrary location within the file system.
- CVE-2025-48386 — a Windows platform-specific vulnerability caused by a buffer overflow in the Wincred handler used for storing credentials in Windows Credential Manager.
Additionally, four vulnerabilities in the Gitk and Git GUI graphical interfaces, written in Tcl/Tk, have been addressed:
- CVE-2025-27613 — opening a specially crafted repository in Gitk may lead to overwriting arbitrary files in the file system.
- CVE-2025-27614 — executing 'gitk filename' on a specially crafted repository may lead to the execution of a script prepared by the attacker.
- CVE-2025-46334 — In Git GUI on Windows, code execution by an attacker can be triggered when a user performs actions such as 'Git Bash' or 'Browse Files' with a repository that contains malicious executable files placed by the attacker, like sh.exe, astextplain.exe, exif.exe, and ps2ascii.exe, invoked during Git GUI operations.
- CVE-2025-46335 — The ability to create or overwrite arbitrary files in the filesystem when a user edits a file in Git GUI from a directory with a specially crafted name extracted from a repository prepared by an attacker.
Source: opennet.ru
