CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a critical vulnerability in Git (CVE-2025-48384) that enables arbitrary file writes and has already been observed in active exploitation campaigns.

The flaw arises from Git’s inconsistent handling of carriage return characters (CR) in its configuration files, potentially allowing threat actors to execute malicious code during repository operations.

When Git reads a configuration value, it strips any trailing carriage return and line feed (CRLF). Conversely, when writing a configuration entry, values with a trailing CR are not quoted, causing the CR to be lost when the configuration is subsequently read.

An attacker can craft a repository with a malicious submodule path containing a trailing CR. During initialization, Git interprets the altered path and checks out the submodule to an unintended location.

If a symbolic link directs the altered path to the submodule hooks directory—and the malicious repository includes an executable post-checkout hook—Git will inadvertently execute the attacker’s script once the submodule is checked out.

CISA warns that this vulnerability is particularly dangerous in environments where users clone or update repositories from untrusted sources.

xOnce code execution is achieved on development workstations, adversaries can escalate privileges, move laterally within the network, or deploy ransomware and other malware.

To mitigate this risk, organizations should:

• Immediately apply any vendor-provided patches or configuration updates addressing CVE-2025-48384.
• Enforce strict access controls on Git repositories, limiting who can push and modify submodules.
• Monitor repository activity for unusual commits or submodule additions.
• Follow CISA’s Binding Operational Directive (BOD) 22-01 for securing cloud services that rely on Git.
• Consider discontinuing use of Git in sensitive environments if immediate patches or mitigations are unavailable.

Security teams should also verify that Continuous Integration/Continuous Deployment (CI/CD) pipelines validate submodule definitions and disallow unexpected characters in paths.

Network defenses—such as intrusion detection systems—should be configured to inspect Git protocol traffic for anomalies indicative of this exploit.

While it remains unclear whether this flaw has been leveraged in ransomware campaigns, the risk of remote code execution merits immediate action.

Administrators are advised to treat this vulnerability with high priority, given its potential to compromise entire development infrastructures.

Development teams and security operators must treat CVE-2025-48384 as an immediate priority.

Given the active exploitation and potential for code injection via Git operations, rapid remediation and stringent policy enforcement are essential to safeguard against malicious repository-based attacks.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!