A recent vulnerability in Git software has been addressed, preventing malicious code execution during recursive clone operations. Identified as CVE-2026-111760, this flaw allowed attackers to execute arbitrary code by exploiting a submodule’s .git file. The Git project has released updates for the 2.50 to 2.56 series, ensuring enhanced protection for users.
Understanding the Git Vulnerability
The vulnerability stemmed from an integer truncation issue when Git handled its index. Attackers could use an excessively long path to bypass safety checks and overwrite submodule .git files with symbolic links pointing to malicious configurations. This clever exploitation could run unauthorized scripts during Git operations.
The vulnerability primarily affected recursive clone operations with submodules. While Git typically prevents overwriting a .git directory with a symbolic link, this restriction didn’t apply to newly cloned submodules where .git is a file, not a directory.
Git’s Response and Fixes
In response to this security threat, the Git project released updated versions, including 2.56.1 and corresponding patches for earlier series. These versions now reject paths that exceed safe length limits, mitigating the risk of this attack vector.
GitHub, a major Git user, has implemented these fixes across its platforms, including GitHub.com and GitHub Enterprise Cloud. For GitHub Enterprise Server, the patches are available in versions 3.19.15 through 3.22.4. Users are encouraged to update their Git installations and related applications promptly.
Additional Security Concerns and Recommendations
The recent Git updates also address five other vulnerabilities, including CVE-2026-113408 and CVE-2026-114467, which could lead to path traversal and denial of service attacks, respectively. GitLab and other hosting services are advised to apply these patches to avoid potential exploitation.
Until users can upgrade to the fixed versions, GitHub advises caution when cloning repositories. Users should only trust reliable sources and avoid processing unverified binary patches. By following these guidelines, users can reduce the risk of falling victim to similar exploits.
The ongoing commitment to securing Git software is critical to maintaining the integrity of numerous projects relying on this essential tool. Staying updated with the latest patches ensures a safer environment for developers worldwide.
