Git Carriage Return Flaw Enables Code Execution During Submodule Initialization

A high-severity vulnerability tracked as CVE-2025-48384 affects Git’s handling of configuration values containing trailing carriage returns, creating a path for unintended script execution during submodule initialization. According to Armis, the flaw can be abused when an attacker can influence the relevant configuration context, potentially turning routine clone or submodule operations into code execution. Microsoft’s Security Update Guide also lists the issue, identifying it as a Git/GitHub vulnerability.

Public exploit activity quickly followed disclosure, with multiple GitHub repositories publishing proof-of-concept material for CVE-2025-48384, including variants described as working over HTTPS and others explicitly labeling the issue as carriage-return-driven remote code execution on cloning. The appearance of several PoC repositories indicates that exploit details are broadly accessible, increasing the likelihood of weaponization against developers and build environments that process untrusted repositories or submodules.