CISA Flags Git CVE-2025-48384 as Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of CVE-2025-48384, a high-severity flaw in Git for macOS and Linux. The bug enables attackers to run code when a weaponized repository is cloned with --recursive. Full technical details and our attack-flow mapping are in our annotated CVE report.
What’s the risk?
The issue stems from Git’s inconsistent handling of carriage-return characters in .gitmodules. An attacker can manipulate submodule paths so Git writes files to unexpected locations—often to plant malicious Git hooks or silently rewrite configuration, leading to remote code execution and source-code exfiltration. CISA has added this CVE to the Known Exploited Vulnerabilities (KEV) catalog, confirming real-world attacks.
Are you vulnerable?
You’re at risk if your Git CLI is older than the patched releases v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, or v2.50.1. GitHub Desktop for macOS is also affected until updated. Windows Git is not impacted.
Quick checks & upgrades
# Check current Git version
git --version
# macOS (Homebrew)
brew info git | head -n1
brew upgrade git
# Debian/Ubuntu
apt policy git | sed -n '1,3p'
sudo apt-get update && sudo apt-get install --only-upgrade git
# RHEL/Fedora
rpm -q git
sudo dnf upgrade git
# Optional: did you recently use --recursive?
history | grep -E "git clone .*--recursive"
# In a repo: list active (non-sample) hooks
ls -l .git/hooks | awk '!/\.sample$/'
How to protect yourself
Upgrade Git everywhere you use it (workstations and CI/CD). Avoid cloning untrusted repositories with --recursive; if you must, review .gitmodules first. Periodically inspect .git/hooks/ for unexpected scripts and ensure build agents use patched Git versions.
Attack flow
This CVE links to specific CWEs, CAPEC patterns, and MITRE ATT&CK techniques that show how a simple clone can escalate into full compromise.
Check out the annotated CVE report for an interactive version of the graph. There you can also consult our Q & A and our A.I. Assistant to discover what mitigation steps you can take
How BaseFortify.eu helps
With BaseFortify.eu you will never miss a threat. We continuously track vulnerabilities like CVE-2025-48384 and map them to your environment, match them with CISA KEV, EPSS likelihood, and MITRE ATT&CK tactics, provide AI-assisted explanations and actionable mitigation steps, and visualize attack flows to show exactly how a flaw can escalate.
You can register for FREE and up to 3 devices or 100 applications to your watch list. Sign up today at basefortify.eu/register
