Git CVE-2025-48384: Recursive Clone Runs Attacker Hooks
Most developer machines picked up the fix in 2025, but stale Git in CI images, build servers and unmanaged Macs is still exposed to a lure-based attack that has been used in the wild; check versions and stop recursive clones of untrusted repos.
Must act: Teams with macOS or Linux developer machines, CI runners or container images carrying Git older than the fixed releases, and anyone who clones third-party repositories with --recursive or via tools that do so by default.
Can relax: Windows users of Git for Windows, which the discoverer says is not directly vulnerable, and hosts already on Git 2.50.1 or later or a fixed distribution package.
- Run git --version (and which -a git on macOS) on developer machines, CI runners and build images; on distro packages, check the package version instead (dpkg -l git or rpm -q git).
- Upgrade to Git 2.50.1 or a later release, a fixed maintenance release, or your distribution's patched package.
- On macOS, update Xcode or the Command Line Tools to 26 or later and GitHub Desktop to 3.5.1 or later; make sure the git first in PATH is a fixed one.