A vulnerability in Git allows arbitrary code execution due to improper handling of trailing carriage return characters in configuration values. Specifically, when initializing a submodule with a path containing a trailing CR, the altered path may cause the submodule to be checked out to an incorrect location. If a symlink points this altered path to the submodule hooks directory and the submodule contains an executable post-checkout hook, the hook script may be executed unintentionally. This flaw is fixed in Git versions 2.50.1 and later.