Git patches six flaws, including code execution on recursive clones
Original title: Git fixes six vulnerabilities, including code execution during recursive clones
Fixes ship in Git 2.56.1 and six older series; GitHub Enterprise Server should move to listed builds.
The Git project released updates for six vulnerabilities that can run attacker-controlled code, write outside intended paths, or corrupt memory when Git handles malicious repositories or crafted input. CVE-2026-111760 can turn a recursive clone into code execution by swapping a submodule .git file for a symlink to malicious hooks. GitHub says fixes are deployed on github.com and Enterprise Cloud, and is coordinating patched builds for Desktop, Copilot, Codespaces, and Actions.
Unconfirmed: The advisory does not say whether any of the six flaws are being exploited.
- CVE-2026-113408 let a malicious v2 server write references outside the intended directory.
- CVE-2026-114467 can overflow a stack array when a message has more than two GPG signatures.
- CVE-2026-114469 and CVE-2026-105437 can crash Git or corrupt heap memory.
- CVE-2026-114466 can read or append files via untrusted git fast-import streams.
- GitHub Enterprise Server fixes are 3.19.15, 3.20.11, 3.21.9, and 3.22.4.
Impact: Code execution, out-of-tree writes, crashes, or file reads
| Product | Affected | Fixed in |
|---|---|---|
| Git | — | 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2 |
| GitHub Enterprise Server | — | 3.19.15, 3.20.11, 3.21.9, 3.22.4 |
- 1.Install Git 2.56.1 or the patched release for the installed series.
- 2.Upgrade GitHub Enterprise Server to 3.19.15, 3.20.11, 3.21.9, or 3.22.4.
- 3.Until patched, avoid recursive clones, merges, binary patches, and fast-import from untrusted sources.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105437 | Heap buffer overflow in Git three-way merge via conflict-marker-size | 7.5 | — | ||
| CVE-2026-111760 | — | — | — | ||
| CVE-2026-113408 | — | — | — | ||
| CVE-2026-114466 | — | — | — | ||
| CVE-2026-114467 | — | — | — | ||
| CVE-2026-114469 | — | — | — |
From the original article
3 min read at helpnetsecurity.com
The Git project has released security updates addressing six vulnerabilities that could allow attackers to execute code, write to unintended files or cause memory corruption when Git processes malicious repositories or other specially prepared input. Code execution during cloning A vulnerability tracked as CVE-2026-111760 stems from an integer truncation in Git’s handling of its index.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.