CISA warns of actively exploited Git code execution flaw

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning of hackers exploiting an arbitrary code execution flaw in the Git distributed version control system. The agency has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and has set the patch deadline for federal agencies to September 15th. Git version control system allows software development teams to track codebase changes over time. The library is the backbone of modern software collaboration, serving as the basis for platforms such as GitHub, GitLab, and Bitbucket. The exploited vulnerability in Git has a high-severity score and is tracked as CVE-2025-48384. It stems from Git's mishandling of carriage return (\r) characters in configuration files. A mismatch between how Git writes and reads these characters causes incorrect submodule path resolution. Attackers can exploit the issue by publishing repositories with submodules ending in \r and a crafted symlink with a malicious hook setup, leading to arbitrary code execution on the machines of users who clone them. Git discovered the issue on July 8, 2025, and pushed fixes in the following versions: 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1. If updating is not possible, the recommendation is to avoid recursive submodule clones from untrusted sources, disable Git hooks globally via core.hooksPath, or enforce only audited submodules. Along with the Git flaw, CISA also added to the KEV catalog two Citrix ...