Git patch closes flaw that let malicious repositories run code during recursive clones
Users who clone repositories with submodules are exposed until they install Git 2.56.1 or a patched 2.50 to 2.55 release.
Git has released version 2.56.1 along with patched 2.50 through 2.55 series releases to close a flaw, tracked as CVE-2026-111760, that lets a malicious repository run attacker code on machines that clone it recursively with submodules. The bug is an integer truncation in index handling: an overlong path passes the safety check but is written under a shortened name of .git, allowing a submodule's .git file to be swapped for a symlink to a folder of malicious hooks or config. GitHub has already deployed fixes to github.com and GitHub Enterprise Cloud, with Enterprise Server fixes in 3.19.15 through 3.22.4, and says Desktop, Copilot, Codespaces and Actions will follow. Until teams install a fixed Git, they should only clone trusted servers, avoid recursive clones of untrusted repositories, and avoid merging untrusted content or processing untrusted binary patches or fast-import streams. Five other Git flaws were fixed in the same releases, including a path traversal via empty-repository clones and a denial-of-service in merges involving tags with multiple GPG signatures.
Why it matters
Developers and hosting providers who clone or merge code from outside sources are the people most affected, since the flaw can run attacker code on the machine doing the clone. Until a fixed Git reaches them, the practical change is caution: clone only trusted servers and avoid recursive clones of untrusted repositories. GitHub has already applied fixes to its own hosted services, while Git for Windows had not yet released a matching version as of Tuesday at 19:09 UTC.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.