Git’s Credentials Comedy of Errors: Carriage Return Bug Exposes Passwords!
Git’s credential retrieval protocol had a bug that could let attackers leak user credentials. This was due to a carriage return smuggling issue, tracked as CVE-2025-23040. GitHub Desktop patched this vulnerability, thanks to researcher RyotaK’s discovery. Git’s latest update also addresses other sneaky credential vulnerabilities.
Hot Take:
Who knew a simple carriage return could be so rebellious? Turns out, your keyboard’s ‘Enter’ key just became the new sidekick for cyber villains, helping them sneak into your Git credentials like a ninja on a sugar rush. Watch out, because your friendly neighborhood Git is getting a patch to stop these mischievous shenanigans!
Key Points:
- Git’s credential protocol was found vulnerable to credential leakage due to improper message handling.
- The vulnerability, CVE-2025-23040, originated from a carriage return smuggling bug in GitHub Desktop.
- Git LFS and Git Credential Manager also shared similar vulnerabilities, allowing credential leaks.
- Git has released patches to address these flaws, with the latest version being 2.48.1.
- Security researcher RyotaK was credited with discovering these vulnerabilities.
Already a member? Log in here