Git Flaw Being Actively Exploited, Says CISA

Two Citrix flaws were also added to the KEV catalogue.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning over active exploitation of a high-severity vulnerability in the Git distributed version control system.

The flaw, tracked as CVE-2025-48384, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue, with federal agencies ordered to apply fixes no later than 15th September.

Git is widely used across the software development ecosystem, forming the foundation of platforms including GitHub, GitLab and Bitbucket.

The security issue arises from Git’s mishandling of carriage return (\r) characters in configuration files. This inconsistency can lead to incorrect submodule path resolution, allowing attackers to publish repositories with malicious submodules and trigger arbitrary code execution on developers’ machines when cloned.

Patched Across Multiple Git Releases

The bug was discovered on 8th July and patched across multiple Git releases, including versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1 and 2.50.1. For organizations unable to upgrade, mitigations include avoiding recursive submodule clones from untrusted sources, disabling Git hooks globally, or only allowing vetted submodules.

CISA has also highlighted two Citrix Session Recording flaws, CVE-2024-8068 and CVE-2024-8069, both of which were addressed by the supplier in November 2024. These issues, rated medium severity, could enable privilege escalation and limited remote code execution on affected systems.

Impacted versions include Citrix Session Recording before 2407 hotfix 24.5.200.8 (CR), 1912 LTSR before CU9 hotfix 19.12.9100.6, 2203 LTSR before CU5 hotfix 22.03.5100.11, and 2402 LTSR before CU1 hotfix 24.02.1200.16.

Like the Git flaw, Citrix customers within the US federal government have until 15th September to apply patches or cease use of vulnerable products.

This article originally appeared on our sister site Computing.