Git Patches Critical Vulnerability Allowing Code Execution Through Malicious Repositories

The Git project has released security updates addressing six vulnerabilities, including a critical flaw that could allow attackers to execute malicious code on systems that recursively clone specially crafted repositories.

Tracked as CVE-2026-111760, the vulnerability involves an integer truncation error in Git’s index handling. It could allow a malicious repository to bypass security checks and execute attacker-controlled code through Git hooks or configuration files.

How the Git Vulnerability Works

The vulnerability occurs when Git processes an extremely long file path inside a repository.

Git initially validates the path length, but an integer truncation issue can cause the path to be written to disk under a shorter name. An attacker can exploit this behaviour to replace a submodule’s .git file with a symbolic link pointing to a directory containing malicious Git hooks or configuration.

When Git subsequently accesses that directory, the malicious hooks can execute attacker-controlled code.

Exploitation requires a victim to recursively clone a malicious repository containing submodules. Therefore, simply visiting or downloading a repository does not automatically trigger the vulnerability.

Six Git Vulnerabilities Addressed

Alongside CVE-2026-111760, the security update addresses five additional vulnerabilities:

CVE-2026-113408: Path traversal vulnerability involving references received from a malicious Git server.
CVE-2026-114467: Stack memory corruption when merging tags containing more than two GPG signatures.
CVE-2026-114469: Out-of-bounds read vulnerability when processing specially crafted binary patches.
CVE-2026-105437: Heap memory corruption during large merge operations.
CVE-2026-114466: File read and write vulnerabilities involving certain Git fast-import features.

These issues could affect developers, code-hosting platforms and automated systems that process untrusted repositories.

Git Releases Security Updates

The vulnerabilities have been addressed in Git 2.56.1, with fixes backported to earlier maintenance branches.

The patched versions include:

Git 2.56.1
Git 2.55.1
Git 2.54.1
Git 2.53.1
Git 2.52.1
Git 2.51.3
Git 2.50.2

GitHub has also deployed fixes across GitHub.com and GitHub Enterprise Cloud. Administrators using GitHub Enterprise Server should upgrade to versions 3.19.15, 3.20.11, 3.21.9 or 3.22.4.