cR0w :cascadia:<p>Three new advisories in git.</p><p><a href="https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/git/git/security/ad</span><span class="invisible">visories/GHSA-vwqx-4fm8-6qc9</span></a></p><p><code>sev:HIGH 8.1 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H</code></p><blockquote><p>When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout.</p></blockquote><p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48384" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">nvd.nist.gov/vuln/detail/CVE-2</span><span class="invisible">025-48384</span></a></p><p><a href="https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/git/git/security/ad</span><span class="invisible">visories/GHSA-m98c-vgpc-9655</span></a></p><p><code>sev:HIGH 8.6 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</code></p><blockquote><p>When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection.</p><p>This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution.</p></blockquote><p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48385" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">nvd.nist.gov/vuln/detail/CVE-2</span><span class="invisible">025-48385</span></a></p><p><a href="https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/git/git/security/ad</span><span class="invisible">visories/GHSA-4v56-3xvj-xvfr</span></a></p><p><code>sev:MED 6.3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N</code></p><blockquote><p>The wincred credential helper uses a static buffer (<code>target</code>) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with <code>wcsncat()</code>, leading to potential buffer overflows.</p></blockquote><p><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48386" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">nvd.nist.gov/vuln/detail/CVE-2</span><span class="invisible">025-48386</span></a></p><p><a href="https://infosec.exchange/tags/patchTuesday" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>patchTuesday</span></a></p>