---
title: CISA confirms active exploitation of Git vulnerability
description: CISA adds Git CVE-2025-48384 to KEV list. Actively exploited flaw risks supply chain attacks on macOS/Linux. Patch Git installations now to stay secure.
---

[Blog, News & Press Releases - Field Effect ](https://fieldeffect.com/blog)

# [CISA confirms active exploitation of Git vulnerability](https://fieldeffect.com/blog/active-exploitation-git-vulnerability)

 Written by [Field Effect Security Intelligence Team](https://fieldeffect.com/blog/author/field-effect-security-intelligence-team) | Aug 26, 2025 6:20:38 PM

On August 25, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability affecting Git project to its [Known Exploited Vulnerabilities](https://www.cisa.gov/news-events/alerts/2025/08/25/cisa-adds-three-known-exploited-vulnerabilities-catalog) catalog, noting its active exploitation.

The vulnerability, tracked as CVE-2025-48384, affects Git installations on macOS and Linux systems. Git project disclosed and [patched the issue](https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9) on July 8, 2025, assigning it a high-severity CVSS score of 8.1 out of 10.

It was addressed in Git versions:

- 2.43.7
- 2.44.4
- 2.45.4
- 2.46.4
- 2.47.3
- 2.48.2
- 2.49.1
- 2.50.1

This flaw exploits trust in the Git workflow. Threat actors could take control of the systems by tricking systems developers or automated build environments into cloning a malicious Git repository.

The attacker doesn’t need to compromise the user directly; instead, they would craft a repository that appears legitimate but contains malicious code. When a developer or CI/CD system clones it, Git’s flawed handling of certain characters allows the attacker’s code to be silently executed.

This could enable attackers to potentially tamper with software during development, steal credentials, or gain deeper access to internal infrastructure.

The vulnerability does not affect Windows systems due to differences in how they process certain special characters, but the risk remains elevated for organizations with mixed environments or open-source dependencies.

Proof-of-concept [exploit code](https://github.com/topics/cve-2025-48384) was released publicly within days of the patch, and security researchers demonstrated how the flaw could be weaponized in real-world scenarios.

## Analyst insight

The vulnerability targets a foundational tool in modern software development, and its exploitation aligns with broader trends in supply chain attacks. Given the nature of the flaw, exploitation can occur without user awareness, making it an effective vector for supply chain compromise.

We recommend patching Git installations immediately and auditing environments for exposure. Security teams should verify Git versions across all developer endpoints and CI/CD infrastructure, prioritizing systems with elevated privileges or access to sensitive repositories.

Where immediate patching is not feasible, temporary workarounds include disabling submodule initialization or enforcing strict repository cloning policies. Organizations should validate Git usage across developer endpoints and CI/CD systems, restrict cloning from unknown sources, and ensure that Git activity is logged and reviewed.

[View full post](https://fieldeffect.com/blog/active-exploitation-git-vulnerability)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Field Effect Security Intelligence Team"
  },
  "dateModified" : "2025-08-26T18:20:38.367Z",
  "datePublished" : "2025-08-26T18:20:38Z",
  "headline" : "CISA confirms active exploitation of Git vulnerability",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1353,
    "url" : "https://8376691.fs1.hubspotusercontent-na1.net/hubfs/8376691/Website-Blog/Blog-Thumb-Threat-Brief_02.jpg",
    "width" : 2401
  },
  "mainEntityOfPage" : "https://fieldeffect.com/blog/active-exploitation-git-vulnerability",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Blog"
  }
}
```