Git versions prior to 2.48.1 do not sanitize URLs when prompting for credentials interactively in the terminal. This allows attackers to craft URLs containing ANSI escape sequences that can manipulate terminal output, potentially misleading users into providing credentials to malicious sites. The issue has been fixed in Git version 2.48.1 and later. Users are advised to upgrade to these fixed versions or avoid cloning from untrusted URLs, especially recursive clones.