Git 2.56.1 Fixes a Flaw Where a Booby-Trapped Repository Runs Code During a Recursive Clone. Update Git and Everything That Bundles It, and Do Not Recursively Clone Anything You Do Not Trust
Update Git to 2.56.1, or the patched release for the series you run, and update every tool that ships its own copy of Git. Until you have, do not run a recursive clone, git clone with --recurse-submodules, on a repository you do not trust. The Git project's November 10 release fixes CVE-2026-111760, where a crafted repository can make Git run attacker-controlled code during that kind of clone. Nobody reports it being used. No public exploit is mentioned in the sources we read.
What has been reported
The primary sources are the Git project's security write-up, published by GitHub on November 10, the GitHub advisory for the Git repository and the 2.56.1 release notes, read for us by an agent. The Hacker News of November 10 matches them. The Git mailing-list announcement returned an access error and we did not read it.
The flaw: per the write-up, "an integer truncation in Git's index handling can cause an extremely long path to pass validation under one name and then be written using a shorter name." An attacker can use that mismatch to replace a submodule's .git file with a symbolic link pointing at a directory holding malicious configuration or hooks. When Git then uses that directory, it can run the attacker's code during a recursive clone.
What triggers it: the advisory says it currently believes this can only be triggered when the --recurse-submodules option is used, and that the attacker's repository is one hosted by the attacker, not on a normal code-hosting site. Severity in the advisory is High, 8.0 out of 10 (CVSS 3.1), and it needs a user to start the clone.
Fixed versions: Git 2.56.1, with fixes backported to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. The advisory page we fetched listed no patched version, which conflicts with the write-up and the release notes. We treat the advisory page as out of date.
Four other Git flaws in the same release, per the write-up: CVE-2026-113408 (path traversal through a server-advertised branch name on an empty clone), CVE-2026-114467 (a stack write past a fixed array when more than two GPG signatures are stripped in tag merges), CVE-2026-114469 (an out-of-bounds read when a binary patch expands past about 1 GiB) and CVE-2026-105437 (a heap overflow in very large merges). A fifth change, CVE-2026-114466, makes unsafe fast-import features require an explicit flag. For CVE-2026-105437 The Hacker News gives a workaround: set conflict-marker-size=7 in info/attributes.
Who ships a fix: GitHub says it deployed fixes on github.com and its enterprise cloud products, and lists GitHub Enterprise Server 3.19.15, 3.20.11, 3.21.9 and 3.22.4. GitHub Desktop, the Copilot app, Codespaces and Actions were still being coordinated. The Hacker News says Git for Windows had no 2.56.1-based release as of 19:09 UTC on November 10.
What it means
The risk is not that someone steals a repository. It is that a repository a developer or a build system clones becomes code running on that machine. The people who clone untrusted repositories automatically are exactly the ones this reaches: continuous integration, dependency checkers, security scanners, code-review tools, and AI coding agents that fetch a repository from a link. The trigger needs a recursive clone, which is common for projects with submodules, so the narrow condition is not much comfort in a build pipeline.
What to do
Update Git to 2.56.1 or the patched release for your series. Check the version with git --version on developer machines and build runners.
Update software that bundles its own Git: IDEs, desktop Git clients, build agents and container images. The write-up says to update applications that bundle Git and Git used by services that process repositories for users.
On Windows, watch for the Git for Windows release built on 2.56.1 and apply it when it appears.
Until patched, do not use --recurse-submodules on repositories you did not create or review. Clone without it, read the submodule list, then fetch the ones you trust.
In automation that clones repositories from outside your organization, run the clone in a disposable, network-limited sandbox with no stored credentials.
Treat an AI agent that clones a repository from a link the same way: it needs the same sandbox.
What is not known
Which Git versions before the fix are affected: the advisory says "all" but does not give a range. Whether anyone has used it. Whether Git for Windows and GitHub Desktop will ship fixes today. We read none of the release notes for the backport versions.
How we know, and how we checked
We read the GitHub write-up of the Git release, the GitHub advisory, the 2.56.1 release notes and The Hacker News report, through an agent. We did not build a malicious repository or test any version. A search of our corpus found no earlier post on this flaw. Our edge check cannot see it: this is a client-side bug in a program, not a web path. We add no indicators to our feed: none are published and there are no network indicators for a client-side bug.
Sources
Git project and GitHub, "Git security vulnerabilities announced," November 10, 2026. GitHub advisory GHSA-vp2w-7xxj-jvxr for the git/git repository. Git 2.56.1 release notes. The Hacker News, "Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones," November 10, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments