A flaw in Git can let a malicious repository run an attacker’s code on a pc that clones it recursively, along with its submodules. The Git undertaking mounted it this week in Git 2.56.1, with matching fixes for the two.50 by way of 2.55 collection in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and a pair of.55.1.
The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. A particularly lengthy path in a repository can go Git’s security test, however Git then writes it to disk below a shorter identify that an attacker can set to .git.
This lets an attacker substitute a submodule’s .git file with a symbolic hyperlink to a folder holding malicious hooks or configuration. Hooks are applications Git runs at set factors, so as soon as Git makes use of that folder, the attacker’s code can run.
Submodules matter right here as a result of Git refuses to interchange a .git folder with a symbolic hyperlink, however in a freshly cloned submodule, .git is a file.
The mounted variations, listed within the Git undertaking’s launch announcement, refuse such extraordinarily lengthy paths earlier than their size will be minimize quick.
GitHub, which ships Git in its personal instruments, defined the fixes in a detailed write-up. It advises putting in a hard and fast model out of your working system or Git distributor, and updating any app that ships its personal copy of Git.
The corporate has already utilized the fixes to github.com and GitHub Enterprise Cloud. For GitHub Enterprise Server, they’re in variations 3.19.15, 3.20.11, 3.21.9 and three.22.4.
Fastened variations of GitHub Desktop and the GitHub Copilot app are being ready. GitHub Codespaces and GitHub Actions will even get the mounted Git.
Git for Home windows had not launched a model primarily based on Git 2.56.1 as of Tuesday at 19:09 UTC, a test of its launch tags by The Hacker Information discovered.
Till a hard and fast model is put in, GitHub suggests these steps, which don’t substitute the fixes:
- Clone solely from servers you belief.
- Don’t recursively clone repositories you don’t belief.
- Don’t merge content material or tags you don’t belief.
- Don’t course of binary patches or fast-import streams from sources you don’t belief.
The Git releases additionally repair 5 different flaws:
- CVE-2026-113408: When somebody clones an empty repository over Git protocol v2, a malicious server can ship a department identify that accommodates path traversal. With the information reference backend, a later replace to that department can then write outdoors Git’s reference folder.
- CVE-2026-114467: Merging a tag that carries greater than two GPG signatures corrupts Git’s stack reminiscence and might trigger a denial of service. Internet hosting companies that run such merges for customers may be affected.
- CVE-2026-114469: A binary patch that expands to a really massive dimension can get previous Git’s patch dimension restrict of about 1 GiB and crash Git with an out-of-bounds learn.
- CVE-2026-105437: A really massive merge, with many conflicts and a big conflict-marker-size attribute, could make Git write previous the tip of a buffer that’s too small, corrupting heap reminiscence.
- CVE-2026-114466: Three git fast-import options, rewrite-submodules-from, rewrite-submodules-to and export-pack-edges, might be used to learn arbitrary information or to create information and add knowledge to them. Git now rejects them in an enter stream except –allow-unsafe-features is about.
GitLab, which assigned CVE-2026-105437, mentioned code-hosting servers are probably to be focused by way of git merge-tree. A server might run that command to test whether or not a pull or merge request will be merged.
The conflict-marker-size attribute will be set in a .gitattributes file dedicated to a repository. If a server reads attributes from the repository, any consumer who can push branches and open a pull or merge request can set off the flaw.
As a workaround for this flaw, servers that can’t improve but can add conflict-marker-size=7 to every repository’s information/attributes file, or flip off these merge checks for untrusted repositories.
