Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

Key Points:

• A critical flaw in Git (CVE-2026-111760) allowed malicious repositories to execute attacker code on computers cloning them recursively with submodules, due to an integer truncation issue in path handling; this has been fixed in Git 2.56.1 and backported to versions 2.50 through 2.55.
• The vulnerability exploited how Git writes long paths to disk with shortened names, enabling attackers to replace submodule .git files with symbolic links to malicious hooks, which Git then executes.
• GitHub has applied the fixes to github.com, GitHub Enterprise Cloud, and upcoming releases of GitHub Desktop, Copilot, Codespaces, and Actions; users are advised to update Git and avoid cloning or merging from untrusted sources until patched versions are installed.
• Additional vulnerabilities fixed in these Git releases include path traversal in branch names, denial of service from tags with multiple GPG signatures, large binary patch crashes, heap corruption from large merges, and unsafe fast-import features that could read or create arbitrary files.
• GitLab highlighted the risk of the heap corruption flaw (CVE-2026-105437) in git merge-tree on hosting servers and recommended workarounds such as setting conflict-marker-size=7 in repository attributes or disabling merge checks for untrusted repositories until upgrades are applied.