Git Fixes 6 Security Vulnerabilities Allowing Hackers to Execute Malicious Code Through Cloned Repositories

The Git project patched six vulnerabilities, including a critical flaw that allows malicious repositories to execute code during recursive cloning. The other five involve unsafe file writes and memory corruption in merges and patches. Git announced the fixes on November 10, 2026.

The patches arrive in Git 2.56.1. They are also backported to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Users should move to 2.56.1 or the latest fix for their release line. Any app that ships its own copy of Git needs an update too.

The most severe flaw is CVE-2026-111760, rated High with a CVSS score of 8.0. Git normally checks file paths before it writes them, and it blocks any path that would overwrite its own repository data.

However, an integer truncation in the index code lets an extremely long path pass the check under one name and then get written under a shorter one.

An attacker can use this to swap a submodule’s .git file for a symbolic link. The link points to a folder holding malicious settings or hooks. When Git later uses that folder, it runs the attacker’s code.

Git Fixes 6 Security Vulnerabilities

The advisory says this appears to need the –recurse-submodules option. The fix rejects overly long index paths before their length can be cut short.

This is not the first time cloned repositories have caused trouble. Cyber Security News covered CVE-2025-48384, which CISA confirmed as exploited, and a Lazarus Group campaign that used a similar symlink trick against developers. Those cases show how quickly attackers turn clone bugs into real attacks.

CVE-2026-113408 affects cloning an empty repository over protocol v2. A malicious server can advertise a HEAD pointer with path-traversal pieces in its name.

Git did not check it, so a later branch update could write outside the intended reference folder. Git now validates the target, along with other reference names it receives over protocol v2.

CVE-2026-114467 is a stack memory bug. When Git removes GPG signatures from a message, it assumes there would be at most two. A crafted tag with more can overflow a fixed-size array. Merging that tag could corrupt memory or crash, and hosting services that merge on behalf of users may also be affected.

CVE-2026-114469 involves binary patches. Git refuses patches above roughly 1 GiB, but it only measured the compressed size. A small crafted patch can expand past the limit, trigger an out-of-bounds read, and crash Git. Git now also checks the declared uncompressed size.

CVE-2026-105437 is a heap corruption bug in large merges. The memory calculation can overflow when many conflicts combine with a large conflict-marker-size setting. Git then allocates too little space and writes past it. Local merges and services that merge untrusted content are both affected.

The last flaw, CVE-2026-114466, hits git fast-import. Three features, rewrite-submodules-from, rewrite-submodules-to, and export-pack-edges, could read or write files outside the repository. They are now blocked in untrusted input unless the caller sets –allow-unsafe-features. Turn that option on only for streams you trust.

GitHub says it has already fixed github.com and its Enterprise Cloud products. GitHub Enterprise Server admins should install 3.19.15, 3.20.11, 3.21.9, or 3.22.4. GitHub Desktop, the GitHub Copilot app, Codespaces, and Actions will also get patched Git builds.

Teams should also check build servers and automation tools, since they often clone repositories without anyone watching. Related risks are growing too, as shown by the GitSpawn flaws that let booby-trapped repositories run code through AI coding agents.

If you can’t update right away, clone only from trusted servers and skip recursive clones of unknown repositories. Also avoid merging untrusted tags or content, and avoid processing outside binary patches or fast-import streams. These steps help, but they do not replace the patch.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Git Fixes 6 Security Vulnerabilities Allowing Hackers to Execute Malicious Code Through Cloned Repositories appeared first on Cyber Security News.