Git Patches High-Severity Vulnerability CVE-2026-111760 Allowing Code Execution via Malicious Repositories
Git released patches on November 10 for six security vulnerabilities, including CVE-2026-111760, which allows arbitrary code execution through malicious submodules during recursive cloning.
The Git project released patches on November 10, 2026, fixing six security vulnerabilities. The most critical is CVE-2026-111760, with a CVSS 3.1 risk score of 8.0 (High). This vulnerability stems from an integer truncation issue when Git processes index data. Attackers can exploit specially crafted long paths to replace a submodule's .git file with a symbolic link pointing to a malicious configuration or hooks directory, causing Git to execute attacker-controlled code during subsequent operations.
According to GitHub, this vulnerability is primarily triggered when users recursively clone repositories and their submodules using the --recurse-submodules option. The other five vulnerabilities cover path traversal, memory corruption, out-of-bounds reads, and unexpected file access. For instance, CVE-2026-105437 can cause heap memory corruption during large merge operations, affecting applications and code hosting services that process merges of untrusted code.
Git has released version 2.56.1 and patched versions for several older maintenance branches. GitHub.com and GitHub Enterprise Cloud have completed the fixes. Updates are also available for GitHub Enterprise Server versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4. GitHub announced that updates for GitHub Desktop and the GitHub Copilot app were still being coordinated at the time of the announcement, while GitHub Codespaces and GitHub Actions will be updated soon.
Enterprises should check if applications embedding Git have received patch updates. The Git project advises users to avoid recursively cloning untrusted repositories until they have applied the updates.