Git’s Latest Release Stops Booby-Trapped Repositories From Running Code When You Clone Them: The Spec Sheet and an Update Checklist
Git 2.56.1 and matching releases for the 2.50 through 2.55 series fix CVE-2026-111760, which let a malicious repository run code on a machine that clones it recursively, plus five other flaws. Here are the versions, the affected tools and the stopgaps.
Cloning a code repository is one of the most routine things a developer does. A newly fixed flaw in Git meant that doing it the wrong way, recursively with submodules, against the wrong repository, could hand an attacker the ability to run code on the developer’s computer. Fixes are out, and in some cases still on their way.
The details below come from The Hacker News coverage of the Git security release, which summarizes the Git project’s announcement and GitHub’s technical write-up.
Spec sheet: the main flaw
- Identifier: CVE-2026-111760
- Bug type: Integer truncation in how Git handles its index.
- Trigger: Recursively cloning a malicious repository, including its submodules.
- Mechanism: A very long path passes Git’s safety check but is written to disk under a shorter name the attacker controls, which can be
.git. That lets the attacker swap a submodule’s.gitfile for a symbolic link to a folder holding malicious hooks or configuration. Because hooks are programs Git runs at set moments, the attacker’s code can execute. - Why submodules: Git will not replace a
.gitfolder with a symbolic link, but in a freshly cloned submodule.gitis a file rather than a folder. - The fix: Patched versions reject such extremely long paths before their length can be cut short.
Spec sheet: fixed versions
- Git: 2.56.1, plus 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1 for older series.
- GitHub.com and GitHub Enterprise Cloud: Already fixed by GitHub.
- GitHub Enterprise Server: 3.19.15, 3.20.11, 3.21.9 and 3.22.4.
- GitHub Desktop and the GitHub Copilot app: Fixed versions being prepared.
- GitHub Codespaces and GitHub Actions: Will receive the fixed Git.
- Git for Windows: No release based on 2.56.1 yet when The Hacker News checked on Tuesday at 19:09 UTC (2:09 p.m. Eastern).
Spec sheet: the other five fixes
- CVE-2026-113408: A malicious server answering a clone of an empty repository over Git protocol v2 can send a branch name containing path traversal, letting a later update write outside Git’s reference folder when the files backend is used.
- CVE-2026-114467: Merging a tag with more than two GPG signatures corrupts stack memory and can crash Git; hosting services that run such merges for users may also be exposed.
- CVE-2026-114469: An oversized binary patch can slip past Git’s roughly 1 GiB patch limit and crash it with an out-of-bounds read.
- CVE-2026-105437: A huge merge with many conflicts and a large conflict-marker-size attribute can overflow a heap buffer. GitLab, which assigned this one, says code-hosting servers running
git merge-treeto check whether a merge request can merge are the likeliest targets. - CVE-2026-114466: Three git fast-import features could be abused to read arbitrary files or create and append to files. Git now refuses them in an input stream unless
--allow-unsafe-featuresis set.
Update checklist
- Run
git --versionon developer laptops, build servers and CI runners, and update to a fixed release from your operating system or Git distributor. - Update any application that bundles its own copy of Git, as GitHub recommends.
- If you self-host GitHub Enterprise Server, move to one of the fixed versions listed above.
- If you self-host a Git server that cannot be upgraded yet, GitLab’s workaround for CVE-2026-105437 is to add
conflict-marker-size=7to each repository’sinfo/attributesfile or switch off merge checks for untrusted repositories. - Until every machine is patched, follow GitHub’s stopgaps: clone only from servers you trust, do not recursively clone untrusted repositories, do not merge untrusted content or tags, and do not process binary patches or fast-import streams from untrusted sources.
- Windows users: watch for a Git for Windows release built on 2.56.1.
What this means for your company
If anyone at your company writes code, maintains a website or runs scripts pulled from online repositories, Git is probably installed somewhere, often in more places than you think. Developer tools are a favorite route into businesses because they run with the user’s full permissions and are rarely covered by normal patch routines. Add developer tools, build servers and bundled copies of Git to your software inventory and patch schedule, and set a simple rule that nobody clones and runs code from unknown sources on a company machine.
Do your patch routines reach the tools your developers and contractors depend on? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
