$ cve CVE-2024-32002 JSON

CVE-2024-32002

9.0

CRITICAL · CVSS 3.1 · EPSS 29.2% (pctl 98)

Patch early

EPSS 29.2% — above the 10% action threshold.

Description

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

Scoring

CVSS	9.0 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS	29.23% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	none known
Published	2024-05-14
Last modified	2026-06-17

Affected (1)

Vendor	Product
git	git

References

→ the Explorer · watch your stack · NVD