Git Patches Flaw Allowing Code Execution via Malicious Recursive Clones

A security flaw in Git (CVE-2026-111760), caused by integer truncation in index handling, could let a malicious repository execute arbitrary code when cloned recursively with submodules. The Git project released fixes in version 2.56.1 and backports for the 2.50-2.55 series.

Disclosed 10 November 2026 · Record updated 10 November 2026

Impact

Malicious repositories could trigger arbitrary code execution on machines performing recursive clones with submodules; patched before confirmed widespread exploitation.

Our coverage

Vulnerabilities

Git patches flaw that lets cloned repositories run code

The Git project has issued fixes for CVE-2026-111760, an integer truncation bug that can turn a recursive clone into code execution.

10 Nov 2026

Sources

thehackernews.comhttps://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html