CVE-2024-32002

CVE-2024-32002 is a critical vulnerability affecting Git versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. This flaw allows an attacker to craft a malicious Git repository with submodules that can write arbitrary files into the .git/ directory during a clone operation, enabling the execution of malicious hooks. Rated with a CVSS score of 9.0 (CRITICAL), the vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, though it requires high attack complexity. The EPSS score of 0.803770000 indicates a high likelihood of exploitation. While not currently listed on the KEV catalog, there is public exploit intelligence, including a detailed write-up on exploiting the vulnerability, and significant community discussion, suggesting active interest and potential for in-the-wild exploitation.