Git Fixes 6 Security Vulnerabilities Allowing Hackers to Execute Malicious Code Through Cloned Repositories

What happened?

The Git project patched six vulnerabilities, including a critical flaw that allows malicious repositories to execute code during recursive cloning. The other five involve unsafe file writes and memory corruption in merges and patches. Git announced the fixes on November 10, 2026. The patches arrive in Git 2.56.1. They are also backported to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Users should move to 2.56.1 or the latest fix for their release line. Any app that ships its own copy of Git needs an update too.

Key details

• Critical flaw allows malicious repositories to execute code during recursive cloning.
• Integer truncation in index code lets long paths bypass path checks and be written under shorter names.
• Attacker can swap submodule .git file for symbolic link pointing to malicious folder.
• CVE-2026-113408: Malicious server can advertise HEAD pointer with path-traversal pieces over protocol v2.
• CVE-2026-114469: Git only measured compressed patch size, allowing small patch to expand past limit and cause out-of-bounds read.
• CVE-2026-105437: Heap corruption in large merges due to memory calculation overflow with many conflicts.
• CVE-2026-114466: fast-import features could read/write files outside repository in untrusted input.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.