cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Git Fixes Flaw That Can Run Malicious Code During Recursive Clones

· Original article ↗

Summary

Git fixed CVE-2026-111760, an integer-truncation flaw that can let a malicious repository run code during recursive clones. The article also describes a separate Git server flaw and available mitigations.

Key points

  • CVE-2026-111760 involves an extremely long repository path that passes Git’s safety check but is written under a shorter name, which an attacker can set to .git.
  • During a recursive clone, the flaw can let an attacker replace a submodule’s .git file with a symbolic link to a directory containing malicious hooks or configuration.
  • Git fixed the flaw in 2.56.1 and in versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1; the fixes reject paths that are too long.
  • GitHub said it applied fixes to GitHub.com and GitHub Enterprise Cloud. GitHub Enterprise Server fixes are in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4.
  • As of Tuesday at 19:09 UTC, Git for Windows had not released a version based on Git 2.56.1. The article says fixed versions of GitHub Desktop and GitHub Copilot were being prepared.
  • A separate flaw, CVE-2026-105437, may affect code-hosting servers that use git merge-tree to check merge requests; repository-controlled conflict-marker-size attributes can trigger it.
  • For servers unable to upgrade for CVE-2026-105437, the article describes setting conflict-marker-size=7 in each repository’s info/attributes file or disabling merge checks for untrusted repositories.

Article Details

Vulnerability Types
  • Integer truncation in Git index path handling
Severity
Unknown
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
partial
Workarounds
  • For the CVE-2026-105437 flaw, add conflict-marker-size=7 to each repository's info/attributes file.
  • For the CVE-2026-105437 flaw, turn off merge checks for untrusted repositories.

CVE

CVE-2026-105437Vendor / Product unavailableGitLab, which assigned CVE-2026-105437, said code-hosting servers are most likely to be targeted through git merge-tree. A server may run that command to check whether a pull or merge request can be merged.CVE-2026-111760Vendor / Product unavailableThe flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An extremely long path in a repository can pass Git's safety check, but Git then writes it to disk under a shorter name that

Vendors

GitHubGitHub, which ships Git in its own tools, explained the fixes in a detailed write-up. It advises installing a fixed version from your operating system or Git distributor, and updating any app that ships its own copy ofGitLabGitLab, which assigned CVE-2026-105437, said code-hosting servers are most likely to be targeted through git merge-tree. A server may run that command to check whether a pull or merge request can be merged.

Products

GitA flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for theGitHub ActionsFixed versions of GitHub Desktop and the GitHub Copilot app are being prepared. GitHub Codespaces and GitHub Actions will also get the fixed Git.GitHub CodeSpacesFixed versions of GitHub Desktop and the GitHub Copilot app are being prepared. GitHub Codespaces and GitHub Actions will also get the fixed Git.GitHub CopilotFixed versions of GitHub Desktop and the GitHub Copilot app are being prepared. GitHub Codespaces and GitHub Actions will also get the fixed Git.GitHub DesktopFixed versions of GitHub Desktop and the GitHub Copilot app are being prepared. GitHub Codespaces and GitHub Actions will also get the fixed Git.GitHub Enterprise CloudThe company has already applied the fixes to github.com and GitHub Enterprise Cloud. For GitHub Enterprise Server, they are in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4.GitHub Enterprise ServerThe company has already applied the fixes to github.com and GitHub Enterprise Cloud. For GitHub Enterprise Server, they are in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4.

Related Articles