Git Submodule Path CRLF Parsing Flaw and Symlink-Based Remote Code Execution (CVE-2025-48384)

1. Vulnerability Overview & Root Cause

This vulnerability stems from a flaw in how Git handles trailing carriage return (CR, \r) characters when reading and writing configuration files such as .gitmodules (CWE-436). When reading a configuration value, Git strips trailing CRLF line endings. However, when writing a configuration entry, values containing a trailing CR are not properly quoted. This causes the trailing CR to be lost or misinterpreted when the configuration is subsequently read, leading to path manipulation.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this behavior by crafting a .gitmodules file where a submodule path contains a trailing CR character.

• When a victim initializes this submodule, Git reads the altered path and checks out the submodule into an unintended, incorrect directory.
• If the repository contains a symbolic link (CWE-59) pointing this altered path to the submodule's hooks directory (.git/modules/.../hooks), the checkout process writes files into the hooks directory.
• If the submodule contains an executable post-checkout hook script, Git will automatically execute this script immediately after checkout, resulting in arbitrary code execution on the victim's machine.

3. Infrastructure & Business Impact

This vulnerability is highly critical and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. It poses a severe threat to developer workstations, CI/CD build pipelines, and automated code analysis environments. Successful exploitation allows attackers to gain initial access, steal proprietary source code, or launch devastating supply chain attacks.