All vulnerabilities
CVE-2025-48384GHSA-vwqx-4fm8-6qc9

Git Link Following Vulnerability

Git Git
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationExploited in the wildAdded to KEV 25 Aug 2025CISA KEV
Exploit odds (EPSS)4.38%Chance of exploitation activity in the next 30 days, higher than 91% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline15 Sep 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 8 Jul 2025, 18:23 UTCPublishedCVE List
  2. 25 Aug 2025Added to CISA KEVCISA KEV

Description

Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.

Text from CVE List

Affected versions 8

  • gitaffected: < 2.43.7CVE List
  • gitaffected: >= 2.44.0-rc0, < 2.44.4CVE List
  • gitaffected: >= 2.45.0-rc0, < 2.45.4CVE List
  • gitaffected: >= 2.46.0-rc0, < 2.46.4CVE List
  • gitaffected: >= 2.47.0-rc0, < 2.47.3CVE List
  • gitaffected: >= 2.48.0-rc0, < 2.48.2CVE List
  • gitaffected: >= 2.49.0-rc0, < 2.49.1CVE List
  • gitaffected: >= 2.50.0-rc0, < 2.50.1CVE List

References 8