Skip to content
Hacker Posts

Git patches CVE-2026-111760: code execution via recursive clone

A malicious repository can run code on a machine that recursively clones it. Fixed in Git 2.56.1 and backports. Part of a six-CVE Git security release.

Published 3 min read
cvegitgithubsupply-chainadvisory

The Git project shipped a security release on November 10 fixing CVE-2026-111760, a flaw that lets a malicious repository execute code on any machine that recursively clones it and its submodules. The fix is in Git 2.56.1 plus backports. If you run CI, build systems, or developer tooling that clones untrusted repos with --recurse-submodules, patch Git.

The primary advisory is GitHub's announcement by Git maintainer Elijah Newren, published November 10.

What the bug does

The root cause is an integer truncation in how Git handles its index. A very long path clears Git's safety check, but Git then writes it to disk under a shorter, truncated name — one an attacker can steer to .git. The attacker replaces a submodule's .git file with a symlink to a directory holding malicious hooks or config; once Git uses that directory, the attacker's code runs.

Git already blocks swapping a .git directory for a symlink, but in a freshly cloned submodule .git is a file, so that check doesn't apply — which is why recursive clones are the trigger. The fix makes Git reject these over-long paths before their length can be truncated.

Affected and fixed versions

  • Fixed: Git 2.56.1, with backports in 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Update to 2.56.1 or the patched release for your maintenance series.
  • GitHub platform: github.com and GitHub Enterprise Cloud are patched. GitHub Enterprise Server fixes are in 3.19.15, 3.20.11, 3.21.9, and 3.22.4.
  • Per The Hacker News, downstream builds lag: Git for Windows, Homebrew, and distro packages may trail the upstream release — check your actual installed version, not the advisory date.

The rest of the release

The same release closes five more CVEs, per the GitHub Blog:

  • CVE-2026-113408 — path traversal via a server-advertised HEAD during clone.
  • CVE-2026-114467 — GPG signature stripping that can corrupt memory when merging tags.
  • CVE-2026-114469 — out-of-bounds read from an oversized binary patch.
  • CVE-2026-105437 — heap overflow in large merges (relevant to git merge-tree).
  • CVE-2026-114466 — unsafe fast-import features, now rejected unless --allow-unsafe-features is set.

No in-the-wild exploitation was reported at release.

Action checklist

  1. Update Git to 2.56.1 (or the patched build for your series) on developer workstations, CI runners, and build agents.
  2. Patch GitHub Enterprise Server to 3.19.15 / 3.20.11 / 3.21.9 / 3.22.4 on your release train.
  3. Pin the Git version in CI images. A base image still carrying an old Git re-introduces the flaw on every pipeline run — rebuild and re-pin.
  4. Until patched, GitHub's interim guidance: clone only from trusted servers, avoid recursively cloning untrusted repositories, and avoid processing untrusted binary patches or fast-import streams. These reduce exposure but don't replace the patch.

Context

This is the same shape as CVE-2025-48384, last year's recursive-clone submodule flaw that abused path handling to drop a malicious hook. The pattern recurs because recursive clone fans out trust to every nested submodule, and Git's path and symlink handling keeps hiding edge cases. CI that clones arbitrary pull requests is the realistic blast radius: an attacker opens a PR from a fork with a crafted submodule and runs code on the runner.

Related stories