The Git project released security updates on November 10 that fix six vulnerabilities. The most serious, CVE-2026-111760, lets a malicious repository run an attacker’s code on the computer of anyone who clones it recursively, meaning together with its submodules. The cause is an integer truncation in how Git handles its index: an extremely long file path can pass Git’s safety check under one name and then be written to disk under a shorter name the attacker controls. That lets the attacker replace a submodule’s .git file with a symbolic link to a folder holding malicious hooks or configuration, and Git then runs them. Neither The Hacker News nor GitHub’s write-up says the flaw is being exploited.
The same release fixes five other flaws: a path-traversal write when cloning an empty repository from a malicious server over protocol v2 (CVE-2026-113408), stack corruption when merging a tag with more than two GPG signatures (CVE-2026-114467), an out-of-bounds read from a crafted binary patch (CVE-2026-114469), heap corruption in very large merges (CVE-2026-105437), and file reads or writes through three git fast-import features (CVE-2026-114466). GitLab, which assigned CVE-2026-105437, said (as reported by The Hacker News) that code-hosting servers are most exposed through git merge-tree, which a server may run to check whether a pull or merge request can be merged. GitHub says it has already applied the fixes on github.com and GitHub Enterprise Cloud.
How to check if you’re affected
Affected versions are Git releases before 2.56.1, and the older maintenance series before their backports: 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. Run git --version and compare it against that list. Update through your operating system or Git distributor, and also update any application that ships its own copy of Git (GitHub points to applications that bundle Git, and to automation and services that process repositories for users). GitHub says fixed builds of GitHub Desktop and the GitHub Copilot app are being prepared, and that GitHub Enterprise Server fixes are in 3.19.15, 3.20.11, 3.21.9 and 3.22.4. The Hacker News reported that Git for Windows had not released a build based on 2.56.1 as of 19:09 UTC on November 10; check its release page for the current state.
Until you can update, GitHub suggests these steps, which it says do not replace the fixes:
- Clone only from servers you trust, and do not recursively clone repositories you do not trust.
- Do not merge content or tags you do not trust, and do not process binary patches or fast-import streams from untrusted sources.
- For CVE-2026-105437 on servers that cannot upgrade, The Hacker News says GitLab’s workaround is to add
conflict-marker-size=7to each repository’sinfo/attributesfile, or to turn off those merge checks for untrusted repositories. - Administrators should also update Git on automation and services that process repositories on behalf of users.