Git RCE via malicious .gitmodules and hooks

9 June 2026 elevated vulnerability technologygovernment-national

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

CVE-2025-48384 in Git before v2.50.1 allows remote code execution through malicious .gitmodules files and Git hooks.

A vulnerability in Git (CVE-2025-48384) enables remote code execution when an attacker crafts a malicious .gitmodules file containing submodule paths with carriage return characters. Git's config parser strips this character on read but preserves it on write, allowing redirection of submodule contents. Combined with symlinks or specific repository layouts, this permits arbitrary filesystem writes and placement of malicious Git Hook scripts. When developers run subcommands like git commit or git merge, the hooks execute with their privileges, achieving RCE. CISA added this to its Known Exploited Vulnerabilities catalog on August 26, 2025, and Datadog researchers have validated working proof-of-concept exploits. Git versions prior to v2.50.1, v2.49.1, v2.48.2, v2.47.3, v2.46.4, v2.45.4, v2.44.4, and v2.43.7 are affected. Organizations should update immediately after testing.

Mentioned in this report

Vulnerabilities CVE-2025-48384KEV

Detection guidance

Git Spawning Shell to Execute Repository Hook Script (Windows)

ATT&CK T1190

git.exe launching sh/bash/cmd/powershell to run a script from a .git hooks directory, the execution stage of CVE-2025-48384 after a malicious submodule plants a hook. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Git Spawning Shell to Execute Repository Hook Script (Windows)
description: Detects git.exe spawning a shell interpreter that runs a script from
  a hooks directory. In CVE-2025-48384 exploitation a malicious .gitmodules (CR in
  submodule path) plants a hook such as post-checkout, which runs when the user does
  git clone --recursive, commit or merge. Legitimate hooks also match, so triage by
  repository origin and hook content.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \git.exe
    Image|endswith:
    - \sh.exe
    - \bash.exe
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - /hooks/
    - \hooks\
  filter_sample:
    CommandLine|contains: .sample
  condition: selection and not filter_sample
falsepositives:
- Developers or CI using legitimate client-side hooks such as pre-commit linters or
  husky
- Corporate-managed Git hook frameworks
level: medium
id: 34eec2b9-d055-5d98-86bc-8e300eb72b95
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-git-could-allow-for-remote-code-execution_2025-078

Git Spawning Interpreter to Execute Repository Hook Script (Linux/macOS-style)

ATT&CK T1190

git launching a shell or interpreter against a script in a hooks directory on Linux, consistent with execution of a hook planted via CVE-2025-48384. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Git Spawning Interpreter to Execute Repository Hook Script (Linux)
description: Detects the git binary as parent of a shell or interpreter whose command
  line references a hooks directory. Relevant to CVE-2025-48384, where a malicious
  submodule layout writes a hook that executes when a developer runs git clone --recursive,
  commit or merge. Legitimate hooks also match, so review the hook origin.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /git
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    CommandLine|contains: /hooks/
  filter_sample:
    CommandLine|contains: .sample
  condition: selection and not filter_sample
falsepositives:
- Developers running legitimate pre-commit or post-merge hooks
- CI runners with standard hook tooling
level: medium
id: 1caedb0d-18f2-5dbe-8e17-642202cf8897
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-git-could-allow-for-remote-code-execution_2025-078

Git Process Writing Non-Sample Hook File in Repository (Windows)

ATT&CK T1190

git.exe creating an executable hook file in a .git hooks directory other than a default .sample template, indicating a hook delivered by a malicious submodule. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Git Process Writing Non-Sample Hook File in Repository (Windows)
description: Detects git.exe creating a file inside a .git hooks directory that is
  not a default .sample template. With CVE-2025-48384 a crafted .gitmodules with carriage-return
  submodule paths redirects submodule content into the hooks directory during clone
  or submodule update. Normal git init and clone only write .sample files.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \git.exe
    TargetFilename|contains: \hooks\
    TargetFilename|contains|all:
    - .git
  filter_sample:
    TargetFilename|endswith: .sample
  condition: selection and not filter_sample
falsepositives:
- Hook managers such as husky or pre-commit installing hooks via git
- Repository templates configured with init.templateDir that contain real hooks
level: medium
id: 858cab64-7b55-5f25-b906-a06bade68309
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-git-could-allow-for-remote-code-execution_2025-078

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-git-could-allow-for-remote-code-execution_2025-078

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs