This critical vulnerability in Git is actively exploited in the wild and allows for potential remote code execution through the manipulation of submodule paths.

The vulnerability stems from improper handling of carriage return characters in Git configuration files, which leads to incorrect path resolution during submodule initialization. An attacker can exploit this to force a submodule to be checked out to a malicious location, potentially leveraging symlinks and executable post-checkout hooks to achieve arbitrary code execution.

Successful exploitation poses a severe risk to development environments and CI/CD pipelines, as an attacker could gain unauthorized execution privileges on developer machines or build servers. Given the CVSS score of 9.5, this vulnerability represents a critical threat to the integrity and confidentiality of source code and deployment infrastructure. The inclusion of this CVE in the CISA Known Exploited Vulnerabilities catalog underscores the immediate risk to organizations.

Immediate Action: Update all Git installations to the patched versions: v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, or v2.50.1.

Proactive Monitoring: Audit Git submodule configurations in critical repositories for unusual path definitions or unexpected symlink targets.

Compensating Controls: Restrict the execution of untrusted Git repositories and ensure that developers are operating in restricted environments where hook scripts have limited access.

Public Exploit Available: Yes, multiple public proof-of-concept repositories are available on GitHub.

Due to active exploitation and the availability of public proof-of-concept code, this vulnerability should be treated as an emergency. Organizations must prioritize the deployment of the provided patches across all development and server-side infrastructure immediately to prevent unauthorized code execution.