Git Link‑Following Vulnerability (CVE‑2025‑48384) Risks Malicious Configuration Exploits
What It Is — Git 2025‑48384 is a link‑following flaw caused by inconsistent handling of carriage‑return (\r) characters in Git’s configuration files. An attacker who can inject a crafted line into a repo’s config can cause Git to follow a malicious URL, potentially leading to arbitrary command execution on the host processing the config.
Exploitability — No public exploit has been released, but the vulnerability scores 7.5 (CVSS v3.1 – High) and can be weaponized in automated CI/CD pipelines that automatically pull and apply configuration files.
Affected Products — All Git installations (client and server) that read configuration files prior to the vendor‑released patch (versions 2.40 and earlier).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure configuration management controls that verify the integrity of critical tooling files.
- Continuous evidence of configuration‑file hygiene supports audit readiness and a defensible control‑assurance posture.
- Enterprises that must prove “secure development” to regulators or partners will be asked to show that such low‑level tool vulnerabilities are mitigated and monitored.
Recommended Actions
- Apply the Git security patch released on 2025‑09‑15 (or later).
- Audit all existing Git configuration files for stray
\rcharacters or unexpected link entries. - Implement automated integrity checks (hash‑based or signed configs) as part of your CI/CD pipeline.
- Log and monitor any Git configuration changes; retain evidence for compliance reviews.
Source: CISA KEV – CVE‑2025‑48384