The Git project released version 2.56.1 to fix six vulnerabilities, the most serious of which, CVE-2026-111760, can give an attacker code execution on a developer’s machine when that developer recursively clones a malicious repository.
The fixes cover all supported branches, and GitHub has already updated its hosted services while client-side updates are still in preparation.
How CVE-2026-111760 Turns a Clone Into Code Execution
The flaw is an integer truncation in Git’s index handling. Very long file paths can slip past safety checks and be written under shortened names that an attacker sets to “.git”. During a recursive clone that includes submodules, the attacker can then replace the submodule .git files with symlinks that point to folders holding malicious hooks. Git runs those hooks, and the attacker’s code executes on the cloning machine.
The attack depends on a victim cloning an attacker-controlled repository with submodules, which is a routine developer action. The risk therefore centers on workflows that fetch code from untrusted or semi-trusted sources.
Backported Releases Cover Six Older Branches
Alongside 2.56.1, the project published backports for older lines: 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. Users on any supported branch can therefore pick up the fix without moving to the newest feature release.
Five Other Git Vulnerabilities Fixed in the Same Release
The release also addresses CVE-2026-113408, a path traversal flaw triggered through branch names under protocol version 2. CVE-2026-114467 is a stack corruption bug that arises from tags carrying multiple GPG signatures. CVE-2026-114469 covers binary patch expansion that exceeds a 1 GiB limit, and CVE-2026-114466 involves unsafe handling in fast-import that could read or create arbitrary files.
CVE-2026-105437 Buffer Overflow in Large Merge Conflicts
CVE-2026-105437 is a buffer overflow that can occur in large merge conflicts. One security outlet separately listed a GitLab heap overflow under the same identifier, so readers tracking this CVE should confirm which product’s advisory applies to their environment before acting on it.
The six flaws span different Git subsystems, from index handling and refs to signature verification and import tooling. That spread indicates that attackers and researchers continue to find memory-safety and path-handling problems across the tool’s long-lived code base, which parses many kinds of attacker-influenced input.
Platform Update Status for GitHub and Windows Users
GitHub.com and GitHub Enterprise Cloud have already been updated against the issues. Fixes for GitHub Desktop and Copilot are in preparation. A Git for Windows build was still pending as of November 10, which leaves Windows developers who depend on that distribution waiting for a packaged update.
For developers who rely on self-managed Git installations, the upgrade is the primary remedy. Until updated builds arrive, the guidance accompanying the release is to avoid recursive clones from untrusted sources, which removes the precondition for the headline vulnerability.
Developer workstations often hold credentials, signing keys and access to source code, so a code-execution path triggered by a clone has consequences beyond a single laptop. Organizations that run automated build systems performing recursive clones face similar exposure on build agents, and those systems should be included when teams inventory which Git versions are deployed.
Developer Workflows Most Exposed to Malicious Repositories
The recursive-clone condition ties the main flaw to specific habits. Developers who evaluate open-source projects, review contributions from unknown parties, or pull dependencies that include submodules clone code they did not write. The hooks that CVE-2026-111760 can plant are ordinary Git hooks, which Git runs automatically in the right circumstances, so the attacker’s payload needs no additional exploit once the repository structure is in place.
Teams that cannot update immediately can follow the guidance to avoid recursive clones from untrusted sources, and can check the version of Git installed on workstations and build servers against the 2.56.1 and backported releases listed above.
