# Git RCE via malicious .gitmodules and hooks

Published: 2026-06-09 · Severity: elevated · Sectors: technology, government-national
Canonical: https://vorant.io/reports/835781cc-f81a-5972-873d-70d57614f4d3/git-rce-via-malicious-gitmodules-and-hooks

> CVE-2025-48384 in Git before v2.50.1 allows remote code execution through malicious .gitmodules files and Git hooks.

A vulnerability in Git (CVE-2025-48384) enables remote code execution when an attacker crafts a malicious .gitmodules file containing submodule paths with carriage return characters. Git's config parser strips this character on read but preserves it on write, allowing redirection of submodule contents. Combined with symlinks or specific repository layouts, this permits arbitrary filesystem writes and placement of malicious Git Hook scripts. When developers run subcommands like git commit or git merge, the hooks execute with their privileges, achieving RCE. CISA added this to its Known Exploited Vulnerabilities catalog on August 26, 2025, and Datadog researchers have validated working proof-of-concept exploits. Git versions prior to v2.50.1, v2.49.1, v2.48.2, v2.47.3, v2.46.4, v2.45.4, v2.44.4, and v2.43.7 are affected. Organizations should update immediately after testing.

## Mentioned in this report

- Vulnerabilities: CVE-2025-48384 (KEV)

## Detection guidance (public sample)

### Git Spawning Shell to Execute Repository Hook Script (Windows)

ATT&CK: T1190

git.exe launching sh/bash/cmd/powershell to run a script from a .git hooks directory, the execution stage of CVE-2025-48384 after a malicious submodule plants a hook. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Git Spawning Shell to Execute Repository Hook Script (Windows)
description: Detects git.exe spawning a shell interpreter that runs a script from
  a hooks directory. In CVE-2025-48384 exploitation a malicious .gitmodules (CR in
  submodule path) plants a hook such as post-checkout, which runs when the user does
  git clone --recursive, commit or merge. Legitimate hooks also match, so triage by
  repository origin and hook content.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \git.exe
    Image|endswith:
    - \sh.exe
    - \bash.exe
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - /hooks/
    - \hooks\
  filter_sample:
    CommandLine|contains: .sample
  condition: selection and not filter_sample
falsepositives:
- Developers or CI using legitimate client-side hooks such as pre-commit linters or
  husky
- Corporate-managed Git hook frameworks
level: medium
id: 34eec2b9-d055-5d98-86bc-8e300eb72b95
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-git-could-allow-for-remote-code-execution_2025-078
```

### Git Spawning Interpreter to Execute Repository Hook Script (Linux/macOS-style)

ATT&CK: T1190

git launching a shell or interpreter against a script in a hooks directory on Linux, consistent with execution of a hook planted via CVE-2025-48384. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Git Spawning Interpreter to Execute Repository Hook Script (Linux)
description: Detects the git binary as parent of a shell or interpreter whose command
  line references a hooks directory. Relevant to CVE-2025-48384, where a malicious
  submodule layout writes a hook that executes when a developer runs git clone --recursive,
  commit or merge. Legitimate hooks also match, so review the hook origin.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /git
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    CommandLine|contains: /hooks/
  filter_sample:
    CommandLine|contains: .sample
  condition: selection and not filter_sample
falsepositives:
- Developers running legitimate pre-commit or post-merge hooks
- CI runners with standard hook tooling
level: medium
id: 1caedb0d-18f2-5dbe-8e17-642202cf8897
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-git-could-allow-for-remote-code-execution_2025-078
```

### Git Process Writing Non-Sample Hook File in Repository (Windows)

ATT&CK: T1190

git.exe creating an executable hook file in a .git hooks directory other than a default .sample template, indicating a hook delivered by a malicious submodule. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Git Process Writing Non-Sample Hook File in Repository (Windows)
description: Detects git.exe creating a file inside a .git hooks directory that is
  not a default .sample template. With CVE-2025-48384 a crafted .gitmodules with carriage-return
  submodule paths redirects submodule content into the hooks directory during clone
  or submodule update. Normal git init and clone only write .sample files.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \git.exe
    TargetFilename|contains: \hooks\
    TargetFilename|contains|all:
    - .git
  filter_sample:
    TargetFilename|endswith: .sample
  condition: selection and not filter_sample
falsepositives:
- Hook managers such as husky or pre-commit installing hooks via git
- Repository templates configured with init.templateDir that contain real hooks
level: medium
id: 858cab64-7b55-5f25-b906-a06bade68309
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-git-could-allow-for-remote-code-execution_2025-078
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-git-could-allow-for-remote-code-execution_2025-078

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/835781cc-f81a-5972-873d-70d57614f4d3/git-rce-via-malicious-gitmodules-and-hooks.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup