Full-text search. Typo-tolerant.

Black Lens Intelligence Desk ·

CVE-2025-48384 - [KEV] - CVSS 8.0

Overview

CVE-2025-48384 is a link-following vulnerability in Git arising from inconsistent handling of carriage return (CR) characters when reading and writing configuration values. Git strips trailing CR characters when reading configuration entries but does not quote or escape them when writing, producing a round-trip inconsistency. An attacker who controls repository content (for example, through a crafted submodule path or configuration entry containing a trailing CR) can cause Git to interpret a different path than the one originally written. When combined with submodule hooks or post-checkout actions, this can result in files being written outside the intended submodule directory, leading to arbitrary file write and, in turn, arbitrary code execution upon a recursive clone.

The vulnerability carries a CVSS score of 8.0 and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2025-08-25, indicating confirmed in-the-wild exploitation. The EPSS score of 0.005 reflects limited automated scanning activity, consistent with targeted rather than mass exploitation patterns typical of supply-chain–style abuse against developer workstations and CI systems.

Affected Products

Exploitation Evidence

No specific exploitation telemetry, victim reporting, or proof-of-concept attribution is recorded in the available evidence database. However, inclusion in the CISA KEV catalog on 2025-08-25 constitutes authoritative confirmation that active exploitation has been observed. The likely exploitation vector is a malicious repository — hosted publicly or delivered via supply chain — that triggers code execution when a victim performs git clone --recursive or otherwise initializes submodules. This pattern places developer endpoints, build agents, and automated dependency-fetch pipelines at primary risk.

ATT&CK Mapping

No formal ATT&CK mappings exist in the source database. Based on the technical mechanism, the following techniques are analytically relevant:

Threat Actor Context

No public threat actor attribution is available in the source data. Vulnerabilities of this class — silent code execution via repository cloning — are historically of high interest to actors targeting software developers, including state-aligned groups previously observed weaponizing developer tooling (e.g., supply-chain operations against npm, PyPI, and GitHub-hosted projects). The KEV listing indicates that at least one operationally capable actor has integrated this flaw into active campaigns.

Recommended Actions