CVE-2025-48384

CVE-2025-48384 is a critical vulnerability in Git that affects various products including Apple, Debian, and Git SCM distributions. It arises from Git's handling of trailing carriage returns in configuration values, which can lead to submodules being checked out to incorrect locations. If a symlink exists pointing the altered path to the submodule hooks directory and the submodule contains an executable post-checkout hook, this can result in unintentional execution of arbitrary code. The vulnerability has a CVSS score of 8.0 (HIGH), indicating a severe risk. It requires low privileges (PR:L) and user interaction (UI:R) but has high attack complexity (AC:H) and can lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The attack vector is network-based (AV:N), allowing remote exploitation. CVE-2025-48384 is actively exploited in the wild, as indicated by its presence in CISA's KEV catalog. While no public exploit code is available on Metasploit, Nuclei, or ExploitDB, there is significant community discussion and media coverage surrounding this vulnerability, highlighting its active exploitation and the urgency for patching.