Git patches six flaws that can run code from cloned repositories
Original title: Git Fixes 6 Security Vulnerabilities Allowing Hackers to Execute Malicious Code Through Cloned Repositories
The worst issue, CVE-2026-111760, scores CVSS 8.0 and needs recursive submodule cloning to swap a .git file for a symlink.
The Git project patched six vulnerabilities on November 10, 2026, in 2.56.1 and several older release lines. The highest-rated flaw lets a malicious repository execute code during recursive cloning through an integer truncation in index paths. GitHub says github.com and Enterprise Cloud are already fixed.
Unconfirmed: The advisory says recursive-submodule use appears necessary for CVE-2026-111760, but does not confirm exploitation.
- Fixes are backported to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2.
- CVE-2026-113408 lets a protocol v2 server advertise a HEAD name with path traversal.
- CVE-2026-114467 can overflow a fixed array when stripping many GPG signatures.
- GitHub Enterprise Server fixes are 3.19.15, 3.20.11, 3.21.9 and 3.22.4.
- Unsafe fast-import features stay blocked unless --allow-unsafe-features is set.
Impact: Code execution from a malicious repository during recursive clone.
| Product | Affected | Fixed in |
|---|---|---|
| Git | — | 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2 |
| GitHub Enterprise Server | — | 3.19.15, 3.20.11, 3.21.9, 3.22.4 |
- 1.Update to Git 2.56.1 or the latest fix on your release line.
- 2.Install GitHub Enterprise Server 3.19.15, 3.20.11, 3.21.9, or 3.22.4.
- 3.Until patched, avoid recursive clones and merges of untrusted repositories.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105437 | Heap buffer overflow in Git three-way merge via conflict-marker-size | 7.5 | — | ||
| CVE-2026-111760 | — | — | — | ||
| CVE-2026-113408 | — | — | — | ||
| CVE-2026-114466 | — | — | — | ||
| CVE-2026-114467 | — | — | — | ||
| CVE-2026-114469 | — | — | — |
From the original article
3 min read at cybersecuritynews.com
The Git project patched six vulnerabilities, including a critical flaw that allows malicious repositories to execute code during recursive cloning. The other five involve unsafe file writes and memory corruption in merges and patches. Git announced the fixes on November 10, 2026.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.