Git CVE-2025-48384: Recursive Clone Runs Attacker Hooks

What to do

1. Run git --version (and which -a git on macOS) on developer machines, CI runners and build images; on distro packages, check the package version instead (dpkg -l git or rpm -q git).
2. Upgrade to Git 2.50.1 or a later release, a fixed maintenance release, or your distribution's patched package.
3. On macOS, update Xcode or the Command Line Tools to 26 or later and GitHub Desktop to 3.5.1 or later; make sure the git first in PATH is a fixed one.
4. Rebuild CI runner and container images that bundle Git rather than relying on host updates.
5. Do not clone untrusted repositories with --recursive or --recurse-submodules; clone, inspect .gitmodules, then run git submodule update --init.

How to check if you are affected or compromised

• Look for executable hooks without a .sample suffix under .git/modules/*/hooks/ in recently cloned repositories.
• Search working copies for files or directories whose names contain a carriage return, which CrowdStrike uses as an exploitation signal.
• Check EDR telemetry for git writing a post-checkout hook and then a shell or Python process running from a hooks directory, and for post-checkout scripts referencing hooks/vm.tf or hooks/mongodb.hook.js.
• Review which third-party repositories developers cloned recursively, especially ones received through job offers, chat or email.

What happened#

On July 8, 2025, the Git project released 2.50.1 and seven maintenance releases fixing CVE-2025-48384 (GHSA-vwqx-4fm8-6qc9, CVSS 3.1 8.0 per GitHub's advisory). When Git reads a config value it strips a trailing carriage return (CR), but when it writes one ending in CR it does not quote it, so the CR is lost on the next read. A malicious repository can give a submodule a path ending in CR. During a recursive clone, Git validates one path but checks the submodule out to another. If the repo also holds a symlink from that altered path into the submodule's hooks directory, an attacker-supplied post-checkout hook runs on the victim's machine.

David Leadbeater, credited with the fix, explained it on July 9. It needs a platform that allows control characters in file names, so macOS and Linux are exposed and Windows "is not directly vulnerable". Datadog validated public proofs of concept within days. CISA added the CVE to the KEV catalog on August 25, 2025, though SecurityWeek found no public reports of the attacks at the time. In October 2025 CrowdStrike reported active exploitation that paired social engineering with malicious repositories. A post-checkout hook used Python to run a first stage named hooks/vm.tf, unpacked a TAR into /tmp, and then deleted the submodule files. No actor has been named.

Who is affected#

Affected: Git before 2.43.7, and each later line before 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1 or 2.50.1. Later releases include the fix. Distributions backported it without changing the base version. Ubuntu 24.04's fixed package is 1:2.43.0-1ubuntu7.3 (USN-7626-1), so git --version alone can mislead. GitHub Desktop 3.5.1 moved its embedded Git to 2.47.3; it clones recursively by default. Apple fixed its bundled Git in Xcode 26 on September 15, 2025.

Do you really need to act?#

The attack needs a victim to clone a hostile repository recursively. That is a lure, not a worm, but a cheap one: developers clone strangers' repositories all the time. Patched laptops are fine. The leftovers are older CI and container images, long-lived build servers, and Macs that run Apple's Git without Xcode updates. On a CI runner the hook runs with the runner's secrets in reach.

What to do now#

1. Check versions everywhere: git --version, plus which -a git on macOS. For distro packages, use dpkg -l git or rpm -q git and compare with your vendor's advisory.
2. Upgrade to Git 2.50.1 or later, a fixed maintenance release, or the patched distro package.
3. On macOS, update Xcode or the Command Line Tools to 26 or later, and GitHub Desktop to 3.5.1 or later.
4. Rebuild CI runner and container images that bundle Git.
5. Never clone untrusted repositories with --recursive, as GitHub's announcement advises. Clone, read .gitmodules, then run git submodule update --init.

How to tell if you were hit#

List non-sample hooks in submodule metadata with find ~/src -path '*/.git/modules/*/hooks/*' -type f ! -name '*.sample'. Find names containing a carriage return with find ~/src -name "*$(printf '\r')*". In EDR, look for git writing a post-checkout hook followed by a shell or Python child running from a hooks directory. CrowdStrike also flags hook scripts referencing hooks/vm.tf or hooks/mongodb.hook.js. If a developer ran a recursive clone from a recruiter or stranger, treat the machine as compromised and rotate its SSH keys, tokens and cloud credentials.

Timeline#

• Jul 8, 2025 — Git 2.50.1 and maintenance releases ship; GitHub Desktop 3.5.1 updates its embedded Git.
• Jul 9, 2025 — David Leadbeater publishes technical details; Datadog follows on July 10 and confirms public proofs of concept work.
• Aug 25, 2025 — CISA adds CVE-2025-48384 to KEV (due September 15, 2025).
• Sep 15, 2025 — Apple fixes its bundled Git in Xcode 26.
• Oct 16, 2025 — CrowdStrike reports active exploitation via social engineering.

Vulnerability records

• CVE-2025-48384 · KEV 2025-08-25 · Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Git / GitHub — GHSA-vwqx-4fm8-6qc9: Arbitrary code execution through broken config quoting github.com
2. CVE record — CVE-2025-48384 cve.org
3. NVD — CVE-2025-48384 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-48384 cisa.gov
5. David Leadbeater (dgl.cx) — CVE-2025-48384 write-up dgl.cx
6. GitHub Blog — Git security vulnerabilities announced (July 2025) github.blog
7. GitHub Desktop — Release 3.5.1 github.com
8. Apple — About the security content of Xcode 26 support.apple.com
9. Ubuntu — CVE-2025-48384 ubuntu.com
10. Datadog Security Labs — Git CLI arbitrary file write (CVE-2025-48384) securitylabs.datadoghq.com
11. CrowdStrike — Falcon defends against Git vulnerability CVE-2025-48384 crowdstrike.com

Coverage and analysis

1. SecurityWeek — Organizations warned of exploited Git vulnerability securityweek.com