Git patches critical code execution flaw in recursive clones

The Git project has released emergency patches to fix a critical vulnerability that allows attackers to execute arbitrary code on a developer's machine. This flaw, identified as CVE-2026-111760, is triggered when a user recursively clones a repository containing malicious submodules. The fixes were published this week across multiple supported versions, requiring immediate attention from engineering teams relying on Git for version control.

What happened

The core issue lies in how Git handles file paths within its index. An attacker can craft a repository with an extremely long path that passes initial safety checks but suffers from integer truncation when written to disk. This truncation shortens the path name, allowing the attacker to manipulate the final filename to match .git. In a freshly cloned submodule, .git exists as a file rather than a directory. The attacker replaces this file with a symbolic link pointing to a folder containing malicious hooks or configuration files. Since Git executes hooks at specific points in its workflow, linking to this controlled folder enables remote code execution.

The Git project addressed this in version 2.56.1 and backported fixes to the 2.50 through 2.55 series, specifically versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, and 2.55.1. GitHub confirmed it has applied these fixes to github.com and GitHub Enterprise Cloud. For self-hosted instances, GitHub Enterprise Server versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4 include the patch. Updates for GitHub Desktop, GitHub Copilot, Codespaces, and Actions are in preparation. However, as of Tuesday at 19:09 UTC, Git for Windows had not yet released a version based on the patched 2.56.1 branch.

How it works

This vulnerability exploits a discrepancy between Git’s internal path validation and the filesystem’s handling of long names. When Git processes the index, it checks the length of the path. If the path is excessively long, an integer truncation error occurs, causing Git to write the file under a shorter, predictable name. By carefully constructing the path, an attacker ensures this shortened name resolves to .git within a submodule directory.

Submodules are particularly vulnerable because their .git entry is initially a file containing a reference to the actual git directory, not the directory itself. Git typically prevents replacing a .git directory with a symlink, but it does not block replacing the .git file. Once the symlink is in place, any subsequent Git operation that triggers hooks will execute scripts from the attacker-controlled location. The patched versions now reject these extremely long paths before truncation can occur, preventing the name collision entirely.

Key details

• Primary Vulnerability: CVE-2026-111760 involves integer truncation in Git’s index handling, enabling code execution via malicious submodules.
• Fixed Versions: Git 2.56.1, plus 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, and 2.55.1.
• GitHub Enterprise Fixes: Available in server versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4.
• Additional Flaws: Five other CVEs were fixed, including path traversal in empty repos (CVE-2026-113408) and heap corruption via large merges (CVE-2026-105437).
• Windows Status: Git for Windows had not released a patched version based on 2.56.1 as of the report time.
• Workarounds: Avoid recursive clones of untrusted repositories and do not process binary patches from unknown sources until updated.

Why it matters

For software engineers and technical leads, this vulnerability highlights the risks inherent in supply chain dependencies. Recursive cloning is a common practice in monorepos and projects with many submodules. If a single submodule is compromised or if a developer clones a malicious fork, the entire development environment could be compromised. This is not just a theoretical risk; automated CI/CD pipelines often clone repositories recursively, potentially exposing build servers to the same exploit.

The presence of five additional vulnerabilities in the same release underscores the complexity of maintaining secure version control systems. Issues like heap corruption from large merges or path traversal in protocol v2 affect hosting services and local clients alike. Teams managing private GitLab or GitHub Enterprise instances must prioritize these updates, as servers running git merge-tree to validate pull requests are specifically targeted by CVE-2026-105437. Delaying patches leaves infrastructure open to denial-of-service attacks and potential data exfiltration.

What you can do

• Upgrade your local Git installation to one of the patched versions immediately, checking your OS package manager or Git distributor.
• If you manage GitHub Enterprise Server, upgrade to version 3.19.15, 3.20.11, 3.21.9, or 3.22.4.
• Avoid using git clone --recursive on repositories from untrusted sources until all systems are patched.
• Configure CI/CD pipelines to skip recursive submodule initialization for external or unverified dependencies.
• For GitLab servers unable to upgrade immediately, set conflict-marker-size=7 in the repository's info/attributes file to mitigate CVE-2026-105437.
• Monitor release tags for Git for Windows and update as soon as a version based on 2.56.1 becomes available.