Git 2.50.1 Patches Seven Security Flaws

The Git project has released version 2.50.1, addressing seven security vulnerabilities that impact all prior versions of Git. The flaws affect core Git operations as well as the bundled Gitk and Git GUI tools, with several allowing arbitrary code execution under specific conditions.

Core Git Vulnerabilities

CVE-2025-48384: Submodule Path Confusion

Git strips trailing carriage return (CR) and line feed (LF) characters when reading configuration values, but does not quote CR characters when writing them. This mismatch can cause submodule paths containing a trailing CR character to be stripped during initialization, leading to the submodule being checked out at an incorrect location. Should a symlink already exist between the stripped path and the submodule's hooks directory, an attacker could leverage the submodule's post-checkout hook for arbitrary code execution.

CVE-2025-48385: Clone Bundle Injection

During repository cloning, Git may fetch a bundle advertised by the remote server to offload cloning work. Insufficient validation of these advertised bundles allows the remote side to perform protocol injection. A specially crafted bundle can direct the client to write data to an arbitrary path, creating a vector for code execution similar to the previous flaw.

CVE-2025-48386: Wincred Buffer Overflow (Windows Only)

The wincred credential helper, which uses the Windows Credential Manager, stores credentials using a key derived from a static buffer. The helper fails to adequately bounds-check the remaining space in this buffer, resulting in potential buffer overflows when cloning from authenticated remotes.

Gitk and Git GUI Vulnerabilities

Both Gitk and Git GUI are Tcl/Tk-based graphical interfaces—Gitk for viewing repository history and Git GUI for repository modifications. Four newly disclosed CVEs affect these tools:

CVE-2025-27613: Gitk File Truncation

Running Gitk in a specially crafted repository without additional command-line arguments can cause the tool to write and truncate arbitrary writable files. This requires the "Support per-file encoding" option to be enabled, though the "Show origin of this line" operation is affected regardless of that setting.

CVE-2025-27614: Gitk Script Injection

A user tricked into running gitk filename where the filename has a particular structure may execute arbitrary scripts supplied by the attacker, leading to arbitrary code execution.

CVE-2025-46334: Git GUI Path Lookup on Windows (Windows Only)

With a malicious repository containing an executable sh.exe or common textconv programs like astextplain, exif, or ps2ascii, Windows path lookup may discover these executables within the working tree. If a user chooses either the "Git Bash" or "Browse Files" menu options, these programs may be invoked, enabling arbitrary code execution.

CVE-2025-46835: Git GUI Directory Traversal

When a user is tricked into editing a file in a specially named directory within an untrusted repository, Git GUI can create and overwrite arbitrary writable files. This flaw is similar to CVE-2025-27613 affecting Gitk.

Mitigation and Remediation

Upgrading to Git 2.50.1 is the most effective defense, as all seven CVEs are resolved in this release. For scenarios where an immediate upgrade is not feasible, several measures can reduce risk:

  • Avoid git clone with --recurse-submodules against untrusted repositories.
  • Set the transfer.bundleURI configuration value to "false" to disable auto-fetching bundle URIs.
  • Refrain from using the wincred credential helper on Windows.
  • Do not run Gitk or Git GUI inside untrusted repositories.

GitHub has scheduled updates for GitHub Desktop to protect users, with GitHub Codespaces and GitHub Actions scheduled to update their Git versions shortly. GitHub's own infrastructure, including Enterprise Server, remains unaffected by these vulnerabilities.