CVE-2025-48064 GitHub Desktop vulnerable to maliciously crafted file renames leading to information disclosure
An attacker can trick a Windows user into viewing a malicious commit, causing Git to access a network share and leak NTLM credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-48064?
CVE-2025-48064 is a low-severity vulnerability in desktop, published on 21 May 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network share. This affects GitHub Desktop users on Windows that view malicious commits in the history view. macOS users are not affected. When viewing a file diff in the history view GitHub Desktop will call `git log` or `git diff` with the object id (SHA) of the commit, the name of the file, and the old name of the file if the file has been renamed. As a security precaution Git will attempt to fully resolve the old and new path via `realpath`, traversing symlinks, to ensure that the resolved paths reside within the repository working directory. This can lead to Git attempting to access a path that resides on a network share (UNC path) and in doing so Windows will attempt to perform NTLM authentication which passes information such as the computer name, the currently signed in (Windows) user name, and an NTLM hash. GitHub Desktop 3.4.20 and later fix this vulnerability. The beta channel includes the fix in 3.4.20-beta3. As a workaround to use until upgrading is possible, only browse commits in the history view that comes from trusted sources.
Weakness: CWE-200
Which versions are affected by CVE-2025-48064?
How do I fix CVE-2025-48064?
No fix has been published for CVE-2025-48064 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-48064 being exploited?
There is no known exploitation of CVE-2025-48064 in the wild and no public exploit code.
Sources
Also known as GHSA-f234-7hj3-vr8j.