Git Patches Critical RCE Flaw in Recursive Clones

The Git project has released patches for a critical remote code execution (RCE) vulnerability, CVE-2026-111760, that could allow malicious repositories to execute arbitrary code on a user’s machine during a recursive clone operation. The flaw, fixed this week, affects various Git versions and has prompted major platforms like GitHub to issue their own updates and guidance.

The primary vulnerability stems from an integer truncation issue in how Git handles its index. Attackers can craft a repository with an extremely long path that bypasses Git’s internal safety checks. When written to disk, this path is truncated, allowing it to overwrite a submodule’s .git file with a symbolic link to a malicious folder.

This malicious folder can contain attacker-controlled Git hooks or configuration files. Once Git interacts with this folder, the attacker’s code can be executed, leading to a full compromise of the developer’s system.

Patches and Affected Versions

The core Git project addressed CVE-2026-111760 in Git 2.56.1. Corresponding fixes were also released for older series, including Git 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, and 2.55.1. Users are strongly advised to update their Git installations immediately. The Git project’s release announcement details these updates.

GitHub, a major provider of Git hosting and tools, has already applied the necessary fixes to github.com and GitHub Enterprise Cloud. For GitHub Enterprise Server users, the patches are available in versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4. GitHub is also preparing fixed versions for GitHub Desktop and the GitHub Copilot app, with updates planned for GitHub Codespaces and GitHub Actions.

Until a fixed Git version can be installed, GitHub recommends several precautionary measures. These include only cloning from trusted servers, avoiding recursive clones of untrusted repositories, refraining from merging untrusted content or tags, and not processing binary patches or fast-import streams from unverified sources. GitHub’s detailed write-up explains the vulnerability and mitigation steps further.

Additional Security Fixes

Beyond the critical RCE flaw, the Git releases also resolve five other security vulnerabilities:

• CVE-2026-113408: A path traversal flaw in Git protocol v2 that could allow a malicious server to write outside Git’s reference folder when an empty repository is cloned.
• CVE-2026-114467: A denial-of-service (DoS) vulnerability caused by stack memory corruption when merging a tag with more than two GPG signatures.
• CVE-2026-114469: An out-of-bounds read that could lead to a crash when Git processes a binary patch expanding beyond its approximately 1 GiB size limit.
• CVE-2026-105437: A heap memory corruption vulnerability during large merges with many conflicts and a large conflict-marker-size attribute. GitLab, which assigned this CVE, noted that code-hosting servers running git merge-tree are particularly susceptible. Workarounds include setting conflict-marker-size=7 in info/attributes or disabling merge checks for untrusted repositories. More details are available via NVD’s record for this CVE.
• CVE-2026-114466: Three git fast-import features (rewrite-submodules-from, rewrite-submodules-to, and export-pack-edges) could be misused to read or create arbitrary files. Git now rejects these in input streams unless --allow-unsafe-features is explicitly set.

The widespread nature of Git in software development workflows underscores the importance of promptly applying these security updates to protect against potential supply chain attacks and developer workstation compromises. More information on CVE-2026-111760 is also available through its NVD entry.