Loading story…
A high-severity vulnerability tracked as CVE-2025-48384 affects Git’s handling of configuration values containing trailing carriage returns, creating a path for unintended script execution during submodule initialization. According to Armis, the flaw can be abused when an attacker can influence the relevant configuration context, potentially turning routine clone or submodule operations into code execution. Microsoft’s Security Update Guide also lists the issue, identifying it as a Git/GitHub vulnerability.
Public exploit activity quickly followed disclosure, with multiple GitHub repositories publishing proof-of-concept material for CVE-2025-48384, including variants described as working over HTTPS and others explicitly labeling the issue as carriage-return-driven remote code execution on cloning. The appearance of several PoC repositories indicates that exploit details are broadly accessible, increasing the likelihood of weaponization against developers and build environments that process untrusted repositories or submodules.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository publishing a proof-of-concept for CVE-2025-48384 was made public. The PoC indicated that exploit details had become publicly available shortly after disclosure.
A vulnerability identified as CVE-2025-48384 was disclosed in Git. The flaw involves improper handling of trailing carriage returns in configuration values, which can trigger unintended script execution during submodule initialization if an attacker can influence the configuration context.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcecve.armis.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a Windows arbitrary code execution flaw in the Cursor AI coding IDE that causes the application to automatically run a malicious `git.exe` placed in the root of a repository when the project is opened. Mindgard said the issue stems from Cursor's Git path resolution logic searching the workspace itself for Git binaries, enabling attacker-controlled code to execute with the developer's privileges without clicks, prompts, or warnings; the payload may also be triggered repeatedly during normal use. In a demonstration, Mindgard renamed Windows Calculator to `git.exe` and showed Cursor launched it simply by opening the poisoned repository. Mindgard said it first reported the vulnerability to Cursor in December 2025, later resubmitted it through HackerOne after contacting the company's CISO, and that the flaw was still present in Cursor version `3.2.16` as of late April 2026 and in the latest version it tested before publication. Cursor told Dark Reading it was addressing the issue. Until a fix is available, Mindgard urged developers to open untrusted repositories only in isolated environments and recommended enterprise Windows controls such as **AppLocker** or **Windows App Control** to reduce exploitation risk.
Jul 18, 2026
A vulnerability tracked as **`CVE-2024-0200`** allowed attackers with organization owner privileges to abuse an unsafe Ruby `Kernel#send()` call in GitHub’s organization repository settings flow and invoke unintended zero-argument methods on `Repository` objects. Researchers showed the bug could be used to trigger `Repository::GitDependency#nw_fsck()` and leak roughly **2 MB of environment variables** from a production GitHub.com container, exposing access keys, secrets, and internal configuration because spawned git processes inherited the parent environment. The issue affected **GitHub.com** and **GitHub Enterprise Server (GHES)** instances with GitHub Actions enabled, but the impact was more severe on GHES. STAR Labs reported that leaked variables on GHES could include `ENTERPRISE_SESSION_SECRET` and other Marshal-related secrets, which could be chained with forged Rails session cookies and an unsafe `Marshal.load` path to achieve **remote code execution**. GitHub hotfixed GitHub.com on December 26, 2023, and later released a patch and advisory, while recommended mitigations included allowlisting the `rid_key` parameter, reducing environment variables passed to git processes, rotating exposed secrets, and monitoring `repository_items` requests for abnormal `rid_key` values.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-64671, was identified in GitHub Copilot for JetBrains, allowing improper neutralization of special elements used in a command, leading to potential command injection and local code execution. The flaw enables an unauthorized attacker to execute arbitrary code on the affected system, with a CVSS 3.1 base score of 8.4, indicating high severity. The vulnerability is not remotely exploitable but can be triggered locally, either through direct access or by tricking a user into executing malicious commands. Security advisories from both cvefeed.io and Microsoft confirm the technical details, highlighting that the vulnerability stems from improper handling of command input within the Copilot integration for JetBrains IDEs. No specific affected product versions have been listed yet, but the issue is confirmed and assigned by Microsoft. Organizations using GitHub Copilot for JetBrains are advised to monitor for updates and apply patches as soon as they become available to mitigate the risk of local code execution attacks.
Jun 29, 2026