Git fixes recursive-clone code execution flaw CVE-2026-111760
Original title: Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
Fixes are Git 2.56.1 and backports for the 2.50–2.55 series; the same releases patch five other flaws.
A malicious repository can run code on a computer that clones it recursively with submodules. An integer truncation in Git’s index lets an extremely long path be written as a shorter name, including .git, so a fresh submodule’s .git file can point at attacker hooks. Git fixed CVE-2026-111760 in 2.56.1 and in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. Those releases also fix five other flaws. GitHub has patched github.com and Enterprise Cloud; Enterprise Server fixes are 3.19.15, 3.20.11, 3.21.9 and 3.22.4.
Unconfirmed: No exploitation in the wild is described, and a Git for Windows build based on 2.56.1 was not found as of Tuesday 19:09 UTC.
- Git for Windows had no 2.56.1-based tag as of Tuesday 19:09 UTC.
- GitHub Desktop and GitHub Copilot app fixes are still being prepared.
- CVE-2026-105437 can be hit through git merge-tree on code-hosting servers.
- Unpatched servers can set conflict-marker-size=7 in info/attributes.
- Unsafe fast-import features now require --allow-unsafe-features.
Impact: Code execution when recursively cloning a malicious repository
| Product | Affected | Fixed in |
|---|---|---|
| Git | 2.50 through 2.55 series; 2.56 before 2.56.1 | 2.56.1, 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1 |
| GitHub Enterprise Server | — | 3.19.15, 3.20.11, 3.21.9, 3.22.4 |
- 1.Install a fixed Git build and update apps that ship their own Git.
- 2.Do not recursively clone or merge content from untrusted sources.
- 3.Until upgraded, set conflict-marker-size=7 in each repository info/attributes file.
- ATT&CK
- T1204.002 Malicious File
- Vendors
- Git
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105437 | Heap buffer overflow in Git three-way merge via conflict-marker-size | 7.5 | — | ||
| CVE-2026-111760 | — | — | — | ||
| CVE-2026-113408 | — | — | — | ||
| CVE-2026-114466 | — | — | — | ||
| CVE-2026-114467 | — | — | — | ||
| CVE-2026-114469 | — | — | — |
From the original article
3 min read at thehackernews.com
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2. 56.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.