Git fixes six flaws enabling code execution in recursive clones

Git has issued Git 2.56.1 along with several maintenance builds to address six security vulnerabilities, spanning from CVE-2026-111760 to CVE-2026-114469. The advisory, reported on 10 November 2026 by Do Son of SecurityOnline[.]info, notes that the flaws could enable code execution during recursive clones, rogue file writes, and memory errors. The advisory lists affected Git branches 2.50 through 2.56 and certain GitHub Enterprise Server builds prior to updates (3.19.15, 3.20.11, 3.21.9 and 3.22.4).

Git 2.56.1 fixes all six issues, with backports in 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. GitHub has already patched GitHub[.]com and Enterprise Cloud.

The report describes the faults as follows. CVE-2026-111760 arises from a length truncation bug in Git’s index code, where a long path can bypass safety checks and be written to disk under a shorter name, allowing an attacker to swap a submodule’s .git file for a symlink to a rogue hooks folder and execute code during a recursive clone.

CVE-2026-113408 affects clones of empty repos over Git protocol v2, with a bad server manipulating a HEAD symref to cause a later branch update to write outside the reference folder. CVE-2026-114466 concerns unprotected fast-import streams, CVE-2026-105437 involves a size overflow during large merges, CVE-2026-114467 triggers memory corruption when stripping GPG signatures from multi-signature tags, and CVE-2026-114469 permits a compressed patch to expand past 1 GiB, causing an out-of-bounds read.

The article notes no confirmed exploitation to date. Administrators are urged to apply Git 2.56.1 or backports and to avoid recursive clones of untrusted repositories until patched.