CVE-2025-48384

HIGHCVSS 8.0Known Exploited

CISA Known Exploited Vulnerability

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 ; https://access.redhat.com/errata/RHSA-2025:13933 ; https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html ; https://linux.oracle.com/errata/ELSA-2025-11534.html ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48384

Remediation deadline: September 15, 2025

Description

Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.

Timeline

Published:July 8th, 2025 7:15 PM

Last modified:September 24th, 2026 1:10 PM

Added to KEV:August 25th, 2025

CVSS Scoring

CVSS v3: 8.0 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

git-scmdebianapple

Products

gitdebian_linuxxcode

Weaknesses (CWE)

CWE-59 CWE-436

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute