Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.
The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An extremely long path in a repository can pass Git's safety check, but Git then writes it to disk under a shorter name that an attacker can set to .git.
Entenda a falha
A vulnerabilidade
CVE-2026-111760 is an integer truncation in how Git handles its index. A malicious repository can lead to code execution on a machine that clones it recursively with its submodules. The attacker only needs the victim to clone the repository, and no authentication is mentioned. Fixed in Git 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. Five other CVEs were fixed in the same releases: CVE-2026-113408 (path traversal in a branch name sent by a malicious server on an empty clone over protocol v2), CVE-2026-114467 (stack corruption when merging a tag with more than two GPG signatures), CVE-2026-114469 (out-of-bounds read from an oversized binary patch), CVE-2026-105437 (heap overflow in large merges) and CVE-2026-114466 (unsafe git fast-import features that read or write files).
Como funciona
When Git clones a repository recursively, it checks each path in the repository against its safety rules. An extremely long path can pass that check, but Git then stores the length in a smaller number and writes the file to disk under a shorter name, which an attacker can set to .git. In a freshly cloned submodule, .git is a file, not a folder, so it can be replaced by a symbolic link pointing to a folder with malicious hooks or configuration. Once Git uses that folder, it runs the hooks, which are programs Git launches at set points, and the attacker's code executes.
Por que é vulnerável
The root cause is that the path length is truncated when converted to a smaller integer type, so the safety check and the name actually written to disk disagree. Git already refuses to replace a .git folder with a symbolic link, but the truncation lets the check be bypassed for submodules, where .git is a file. The fixed versions refuse such extremely long paths before their length can be cut short. The articles do not say why this went unnoticed.
Como foi descoberta
The articles do not say who found CVE-2026-111760 or how. The fixes were announced in the Git project's release announcement, and GitHub published a detailed write-up. GitLab assigned CVE-2026-105437 and said code-hosting servers are most likely to be targeted through git merge-tree.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 17:15.
Linha do tempo
-
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
ler a análise desta fonte ocultar
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.
The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An extremely long path in a repository can pass Git's safety check, but Git then writes it to disk under a shorter name that an attacker can set to .git.