The Git project has released updates fixing six security vulnerabilities, including a flaw that can execute attacker-controlled code when a developer recursively clones a malicious repository. The November 10 release affects the Git version-control software and applications that bundle it, with GitHub also shipping fixes across its hosted services and enterprise products.
The most serious issue, CVE-2026-111760, stems from integer truncation in Git’s index handling. An extremely long path can pass a security check under one name and then be written under a shorter name, allowing a malicious repository to replace a submodule’s .git file with a symbolic link. That link can point to a directory containing attacker-controlled configuration or hooks, which Git may execute during a later recursive clone. The flaw therefore depends on a victim cloning a specially prepared repository recursively; the disclosure does not describe it as an unauthenticated remote attack against a Git server.
The other five vulnerabilities affect different parts of Git. CVE-2026-113408 allows path traversal through a malicious server’s advertised HEAD reference. CVE-2026-114467 can corrupt stack memory when Git strips multiple GPG signatures from a message, potentially causing a denial of service. CVE-2026-114469 can trigger an out-of-bounds read when applying a compressed binary patch. CVE-2026-105437 can corrupt heap memory during very large merges, while CVE-2026-114466 allows certain fast-import stream features to read files outside a repository or create and append to files.
The fixes are included in Git 2.56.1 and backported to versions 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. GitHub says it has deployed fixes across github.com, GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Patches for GitHub Enterprise Server are available in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4. The company is also coordinating releases of GitHub Desktop and the GitHub Copilot app with patched Git components, while Codespaces and GitHub Actions will receive updated versions.
The disclosure adds to recent security issues affecting developer platforms, including Gitea’s fixes for token and workflow vulnerabilities and the Gheist campaign that abused stolen GitHub tokens to steal repository secrets. GitHub published the technical breakdown and patched-version list in its November 10 security announcement.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
