Git security vulnerabilities announced
Our summary
The Git project has shipped new releases closing six security holes, the most severe being CVE-2026-111760, which lets a malicious repository achieve arbitrary code execution during a recursive clone by abusing an integer-truncation bug in index path handling to plant a symlinked submodule hook. Other fixes address CVE-2026-113408 (path traversal via a server's spoofed HEAD symref over protocol v2), CVE-2026-114467 and CVE-2026-105437 (stack and heap corruption when stripping multiple signatures or merging oversized conflict output), CVE-2026-114469 (out-of-bounds read from oversized binary patches), and CVE-2026-114466 (unsafe file access through fast-import stream features). All issues are resolved in Git 2.56.1, with backports available for the 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2 maintenance lines. GitHub has already deployed the fixes on github.com and Enterprise Cloud, released updates for GitHub Enterprise Server (3.19.15, 3.20.11, 3.21.9, 3.22.4), and is rolling out patched Git builds for Desktop, Copilot, Codespaces, and Actions. Users and administrators are urged to update promptly, especially anyone running automation that clones, merges, or processes patches from untrusted sources.
Below is the opening; the full story is at GitHub Security Lab.
From GitHub Security Lab
Today, the Git project is releasing new versions to address six security vulnerabilities. These include arbitrary code execution when recursively cloning a malicious repository, writes to unintended files, and memory corruption when processing merges or binary patches.
The fixes are included in Git 2.56.1, with backports to Git 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. We recommend updating to Git 2.56.1 or the patched release for your maintenance series, and updating any applications that bundle Git.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.