Fix: Update Git immediately. Seriously.

Git is used by every developer in open source, in enterprise and even, in their personal projects. It’s been well tested for nearly two decades.

CVE-2025-48384, disclosed recently, a vulnerability in Git that allows attackers to run code on your machine, steal data, or quietly sneak around your network by exploiting unquoted carriage returns in submodule paths.

This article explains the vulnerability, mechanics, and specific mitigation steps to secure your Git environment.

How It Works

• When Git reads a configuration value, it automatically strips any trailing carriage return (CR) or line feed (LF).
• When writing a configuration entry that ends with a CR, Git fails to quote it properly. That rogue CR is stripped the next time the config is read.
• During submodule initialization, a trailing CR in a submodule path can cause Git to misinterpret the location, checking out the submodule somewhere unintended.
• If a symlink points this misdirected path to a sensitive location — like the submodule’s hooks directory — and the submodule contains an executable post-checkout hook, Git will unknowingly run it after…