Windows apps · Application version · March 17, 2025
Git 2.49.0
Git 2.49.0, released March 17, 2025, fixes 4 CVEs in Git. One of them is being exploited (CVE-2025-48384); 1 on CISA KEV. Patch Radar priority: Patch now. The latest Git is 2.56.0.4, which also fixes every one of these CVEs.
Patch now1 on CISA KEV
Superseded. The latest Git is 2.56.0.4, which also fixes every CVE on this page. Install that instead.
CVEs closed
4
None rated Critical
Exploited
1
CVE-2025-48384
Highest CVSS
8.6
Base score, 0 to 10
Highest EPSS
0.0438
91st percentile
Priority of the 4 CVEs
Patch now 1
Urgent 0
High 2
Routine 1
Applies to
| Product | Version |
|---|---|
| Git | 2.49.0 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2025-48384 | GitHub: CVE-2025-48384 Git Symlink Vulnerability | 8.3 | 0.0438 | KEVExploited |
| High | CVE-2025-48385 | GitHub: CVE-2025-48385 Git Protocol Injection Vulnerability | 8.6 | 0.0106 | None reported |
| High | CVE-2024-52005 | The sideband payload is passed unfiltered to the terminal in git | 7.5 | 0.0051 | None reported |
| Routine | CVE-2025-48386 | GitHub: CVE-2025-48386 Git Credential Helper Vulnerability | 6.3 | 0.0043 | None reported |
Showing 1 to 4 of 4
1
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.