Git patches six flaws, including recursive-clone code execution

Git 2.56.1 and six maintenance releases fix six vulnerabilities, including code execution during recursive clones of malicious repositories.

The Git project released fixes for six vulnerabilities in recursive clones, reference handling, merges, binary patches, and fast-import. The most serious, CVE-2026-111760, can run attacker-controlled code when a recursive clone of a malicious repository uses integer truncation so a long path replaces a submodule .git file with a symlink to malicious hooks. Other bugs can write outside the intended reference directory, corrupt memory, crash Git, or let untrusted fast-import streams read or write files. Fixed versions are 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. GitHub says it patched github.com and Enterprise Cloud and published Enterprise Server updates 3.19.15, 3.20.11, 3.21.9 and 3.22.4.