High · published July 8, 2025
CVSS calls it high at 8.0. It is confirmed in active exploitation. It sits in the 91.2th percentile for exploit probability.
🚨 A sneaky CRLF vulnerability lies in Git's handling of submodule paths! An unassuming carriage return could lead to chaos when executing scripts! ⚡ Think of it like a delivery service misreading an address because of an extra line break in the instructions — your package (submodule) ends up in the wrong place, and the delivery driver (Git) accidentally triggers an unexpected surprise (executable hook). An attacker can exploit this vulnerability to execute unintended scripts in your repository after a submodule checkout, potentially leading to data loss or further system compromise. This could disrupt your development processes and create openings for more serious breaches.
Think of it like a delivery service misreading an address because of an extra line break in the instructions — your package (submodule) ends up in the wrong place, and the delivery driver (Git) accidentally triggers an unexpected surprise (executable hook). This vulnerability occurs when Git fails to properly quote trailing CR in config values, causing incorrect submodule paths and possibly executing a malicious script if a symlink exists that points to the altered path.
An attacker can exploit this vulnerability to execute unintended scripts in your repository after a submodule checkout, potentially leading to data loss or further system compromise. This could disrupt your development processes and create openings for more serious breaches. Update your Git installation to at least version 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, or 2.50.1 to mitigate this issue. Be sure to review any submodule paths in your configurations to avoid this sneaky problem. You've got this! Patch your Git and lock down your submodules like the security hero you are! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| git-scm/git | < 2.43.7 | 2.43.7 |
| git-scm/git | ≥ 2.44.0, < 2.44.4 | 2.44.4 |
| git-scm/git | ≥ 2.45.0, < 2.45.4 | 2.45.4 |
| git-scm/git | ≥ 2.46.0, < 2.46.4 | 2.46.4 |
| git-scm/git | ≥ 2.47.0, < 2.47.3 | 2.47.3 |
| git-scm/git | ≥ 2.48.0, < 2.48.2 | 2.48.2 |
| git-scm/git | ≥ 2.49.0, < 2.49.1 | 2.49.1 |
| git-scm/git | ≥ 2.50.0, < 2.50.1 | 2.50.1 |
| debian/debian_linux | all versions | — |
| apple/xcode | < 26.0 | 26.0 |