Summary
- Git's 10 November security releases correct six vulnerabilities involving repository cloning, references, merges, binary patches, and imports.
- CVE-2026-111760 could allow attacker-controlled code execution during recursive cloning of a malicious repository.
- Fixes are available in Git 2.56.1 and supported maintenance releases, with bundled Git installations also requiring attention.
Development environments face new security risks after the Git project released fixes for six vulnerabilities, including a weakness that could allow an attacker to execute code when a developer recursively clones a malicious repository.
The coordinated security updates were published on 10 November, addressing flaws in repository cloning, reference handling, merging, binary patch processing, and data imports.
The fixes are included in Git 2.56.1, with backported releases available for maintained earlier versions: 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2.
The maintainers recommend updating Git and applications that include separate Git installations. The vulnerabilities have different prerequisites and possible consequences, so they should not be treated as a single remotely exploitable defect affecting every repository operation.
Recursive cloning can trigger code execution
One of the most significant issues, CVE-2026-111760, involves an integer truncation error in Git’s handling of long repository paths.
Git normally checks paths before writing files into a working tree, including attempts to replace its own repository metadata. Under affected conditions, an exceptionally long path can pass validation under one name before being written using a shortened name.
A specially crafted repository may exploit the discrepancy during recursive cloning, leading Git to use attacker-controlled configuration or hooks and potentially execute code.
The weakness requires a malicious repository and the affected operation. It does not mean every ordinary clone leads to code execution, or that a Git installation is automatically compromised merely by being present on a system.
Nevertheless, automated build processes sometimes clone external repositories and nested dependencies without a developer examining the contents in advance. Their exposure depends on the source of repository content and the privileges available to the process.
Reference handling crosses another boundary
CVE-2026-113408 concerns reference information supplied by a remote server when cloning an empty repository using version two of the Git protocol.
A malicious server could advertise a reference containing path traversal components. A subsequent operation might then write outside the intended reference directory under affected conditions.
The correction validates the advertised reference name and related targets before accepting them.
Other vulnerabilities affect operations involving unusually structured repository data. CVE-2026-114467 concerns memory corruption when removing signatures from a specially crafted message containing more signatures than the affected code expected.
CVE-2026-114469 involves an out-of-bounds read when processing a compressed binary patch, potentially causing the application to crash.
CVE-2026-105437 relates to memory allocation during exceptionally large merge operations and can cause heap corruption.
These issues have different technical outcomes. Public advisories do not justify describing all six as equivalent unauthenticated remote code execution vulnerabilities.
Import tools could reach unintended files
CVE-2026-114466 affects selected functionality within Git’s fast-import interface. Under affected conditions, an untrusted input stream could cause files outside the intended repository to be read, created, or modified.
The project now requires explicit permission through its unsafe-features mechanism for operations that carry that risk. Legitimate tools relying on those operations may require compatibility checks following the update.
All six disclosures concern the boundary between repository content received from outside a system and operations performed by a trusted local application.
Build infrastructure also needs updates
Git is used throughout enterprise software development, from laptops and continuous integration runners to self-hosted platforms and automated deployment environments.
Updating the operating system’s Git package may not address development applications that bundle their own executable. Administrators need an inventory of the versions used across those environments, including containers and build agents.
GitHub has said it deployed fixes within its hosted services and provided applicable releases for GitHub Enterprise Server. Other software that embeds Git requires separate vendor guidance.
Where immediate updating is not possible, limiting recursive clones of untrusted repositories and restricting privileged build workflows can reduce exposure, but these measures do not replace installation of corrected releases.
GitHub’s technical security analysis sets out the vulnerabilities and maintenance versions.
No active exploitation campaign has been established by the release. Its findings show how errors in a foundational development tool can allow untrusted repository content to influence local files and, in particular circumstances, executable operations.
