CVE-2025-48384: Git submodule hook execution flaw

Git CVE-2025-48384 is a vulnerability in the submodule initialization process that exploits a flaw in CRLF (carriage return line feed) handling. When Git reads a config value, it strips trailing CRLF; when it writes one, however, values with trailing CR are not properly quoted, causing the CR to be lost when read again. This behavior creates a discrepancy: a submodule path containing trailing CR is altered during checkout.

Rated CVSS 8.0, the vulnerability is classified as high. Concrete risk activates only under specific conditions: a symlink pointing the altered path to the submodule hooks directory, combined with an executable post-checkout hook present. If these elements align, the hook script is executed unintentionally, enabling arbitrary code execution. The flaw has been confirmed for some time; patches have been available from Git maintenance branches since 2025. Active research signals were detected on GitHub on November 3, 2026.

Administrators must first verify the Git version in production and CI/CD systems, updating to v2.50.1 or the correct version for the branch in use. Review submodule configurations and identify paths with non-printable characters or trailing CR. Check for anomalous symlinks in hook directories. Audit post-checkout hooks to identify unauthorized activity or suspicious code. Implement integrity checks on critical repositories and restrict access to submodule configuration.

Although the CVE dates to 2025 and patches have been available for some time, the persistence of unpatched systems remains a real risk in environments with slow patch cycles or complex deployments. Active research suggests this vulnerability continues to receive security community attention, making timely verification of update status important.