---
title: CISA Warns of Active Attacks Exploiting Critical Git Vulnerability
description: CISA alerts to a critical Git flaw CVE-2025-48384 exploited on macOS and Linux, urging urgent updates to avoid remote code execution.
canonical_url: https://codekeeper.co/ticker/cisa-git-vulnerability-cve-2025-48384
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# CISA Warns of Active Attacks Exploiting Critical Git Vulnerability

CISA alerts to a critical Git flaw CVE-2025-48384 exploited on macOS and Linux, urging urgent updates to avoid remote code execution.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 26, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

CISA added a critical Git vulnerability (CVE-2025-48384) to its Known Exploited Vulnerabilities catalog Monday, warning that attackers are actively exploiting the flaw. The bug allows hackers to manipulate Git repositories with malicious .gitmodules files, potentially achieving remote code execution when developers clone infected repos. The vulnerability affects macOS and Linux systems but not Windows. It stems from Git's handling of carriage return characters in submodule paths, letting attackers write files to unexpected locations. Git patched the issue in July across multiple versions, but CISA now requires federal agencies to update by September 15. Software developers and CI/CD systems remain primary targets. **Source:** [Security Week](https://www.securityweek.com/organizations-warned-of-exploited-git-vulnerability/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-git-vulnerability-cve-2025-48384%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Critical RCE Flaws in Cursor IDE Let Attackers Escape Sandbox With Zero Clicks Aug 12, 2026](https://codekeeper.co/ticker/cursor-ide-vulnerabilities-remote-code-execution)

[Software security Attackers Are Exploiting a Maximum-Severity Cisco ISE Flaw Sep 21, 2026](https://codekeeper.co/ticker/cisco-patches-critical-ise-vulnerability)

[Cyberattacks AI-Powered Attacks Are Actively Targeting U.S. Critical Infrastructure, Agencies Warn Aug 20, 2026](https://codekeeper.co/ticker/ai-scripts-threaten-critical-infrastructure)

[Cyberattacks Ceva Logistics Cyberattack Disrupts European Operations, Exposes Customer Data Aug 26, 2026](https://codekeeper.co/ticker/ceva-logistics-cyberattack-disrupts-operations)