{"schema":"threatline.record/2","record":{"id":"CVE-2025-48384","aliases":["GHSA-vwqx-4fm8-6qc9"],"summary":"Git Link Following Vulnerability","details":"Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.","categories":["Unclassified"],"product":"Git","vendor":"Git","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-48384","source_modified_at":"2026-02-26T17:51:05.174Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"git","vendor":"git","versions":[{"version":"< 2.43.7","status":"affected"},{"version":">= 2.44.0-rc0, < 2.44.4","status":"affected"},{"version":">= 2.45.0-rc0, < 2.45.4","status":"affected"},{"version":">= 2.46.0-rc0, < 2.46.4","status":"affected"},{"version":">= 2.47.0-rc0, < 2.47.3","status":"affected"},{"version":">= 2.48.0-rc0, < 2.48.2","status":"affected"},{"version":">= 2.49.0-rc0, < 2.49.1","status":"affected"},{"version":">= 2.50.0-rc0, < 2.50.1","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":8.1,"severity":"High","kev":{"listed":true,"date_added":"2025-08-25","due_date":"2025-09-15","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.04379,"percentile":0.91249,"score_date":"2026-10-23"},"published_at":"2025-07-08T18:23:48.710Z","modified_at":"2026-02-26T17:51:05.174Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-48384","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-02-26T17:51:05.174Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-48384","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","EPSS"],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:13933","source":"CISA KEV"},{"url":"https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html","source":"CISA KEV"},{"url":"https://linux.oracle.com/errata/ELSA-2025-11534.html","source":"CISA KEV"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384","source":"CISA KEV"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48384","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384","tags":["government-resource"]},{"source":"CVE List","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2025-08-26T03:55:23.181071Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-02-26T17:51:05.174Z","content_hash":"fc39ae75e6e185003eefc9d5eab4fe728aded8b07326a8f174e9194f472032dc"}}