Git Flaw CVE-2026-111760 Lets Malicious Repos Run Code
Git fixed `CVE-2026-111760`, a flaw that lets a malicious repository run attacker code on a machine that clones it recursively with submodules. The fix is in 2.56.1, with backports for the 2.50 to 2.55 series.
⚡ Why it matters
Recursive clones with submodules happen daily on developer machines and in CI/CD, so one malicious repo could compromise a developer laptop or build server.
How it works
The root cause is an integer truncation in Git's index handling. An extremely long path passes Git's safety check, but Git writes it to disk under a shorter name that the attacker can make .git. The attacker can then swap the .git file of a submodule for a symlink pointing to a folder with malicious hooks or settings. Hooks are programs Git runs at set points, so the attacker's code executes.
Submodules are key: Git blocks swapping a .git directory for a symlink, yet a newly cloned submodule stores .git as a plain file.
Fixed versions
- Git 2.56.1, plus 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.
- GitHub has patched github.com and GitHub Enterprise Cloud. GitHub Enterprise Server fixes are in 3.19.15, 3.20.11, 3.21.9 and 3.22.4.
- Fixed GitHub Desktop and GitHub Copilot app builds are in progress.
- As of Tuesday evening, Git for Windows had not shipped a 2.56.1-based release.
The releases also fix five other flaws, including CVE-2026-113408, a path traversal from a malicious server.
What to do
- Update Git from your OS or distributor, and update any app that bundles its own Git.
- Until then, avoid
git clone --recursiveon untrusted repos and clone only from trusted servers. - Do not merge content or tags from untrusted sources.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.