Critical Git Flaw Patched: Malicious Repositories Could Execute Code During Clones

Major Security Update: Git Addresses Critical Code Execution Vulnerability

Developers worldwide rely on Git for version control, making its security paramount. This week, the Git project rolled out a crucial update, patching a significant flaw that could allow malicious repositories to execute arbitrary code on a user’s machine during recursive cloning operations. This vulnerability, tracked as CVE-2026-111760, highlights the continuous need for vigilance in software supply chains.

Understanding the Recursive Clone Vulnerability (CVE-2026-111760)

At its core, CVE-2026-111760 is an integer truncation bug within Git’s index handling. The exploit hinges on a clever manipulation of file paths:

• An attacker crafts a repository containing an extremely long path.
• This path initially bypasses Git’s internal safety checks due to its length.
• However, when Git writes this path to disk, an integer truncation occurs, shortening the path.
• Crucially, the attacker can design the path so that its truncated version resolves to .git.

This allows a malicious actor to replace a submodule’s legitimate .git file with a symbolic link pointing to a folder containing their own malicious hooks or configuration. Since Git executes these ‘hooks’ at predefined stages of its workflow, the attacker’s code can then run on the unsuspecting user’s system. The critical distinction here is that while Git typically prevents replacing a .git folder with a symbolic link, a freshly cloned submodule initially presents .git as a file, making it susceptible to this attack.

The Fix and What You Need To Do

The Git project swiftly addressed this issue, releasing fixes in Git 2.56.1, along with backports for older series (2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, and 2.55.1). These patched versions now proactively reject excessively long paths before they can be truncated, effectively closing the exploit window.

GitHub, a major proponent and user of Git, has provided a detailed explanation of the fixes and has already applied them to its core services, including github.com and GitHub Enterprise Cloud. Updates for GitHub Enterprise Server (versions 3.19.15, 3.20.11, 3.21.9, 3.22.4), GitHub Desktop, GitHub Copilot, GitHub Codespaces, and GitHub Actions are also being rolled out or prepared.

Immediate Action Required: Users are strongly advised to:

• Install the latest fixed version of Git from their operating system’s package manager or Git distributor.
• Update any applications that ship their own embedded copies of Git.

Interim Safeguards and Best Practices

While awaiting updates, GitHub recommends several crucial precautions:

• Clone only from trusted sources:Exercise

  extreme caution when cloning repositories, especially those with submodules, from unknown or untrusted origins.

• Avoid untrusted recursive clones: Do not use git clone --recursive on repositories you do not explicitly trust.
• Scrutinize merges: Refrain from merging content or tags from untrusted sources.
• Beware of untrusted patches: Do not process binary patches or fast-import streams from unverified sources.

Beyond the Main Flaw: Five Additional Vulnerabilities Patched

The recent Git releases weren’t limited to addressing CVE-2026-111760. Five other significant vulnerabilities were also patched, reinforcing the importance of keeping your Git installations up-to-date:

Path Traversal via Git Protocol v2 (CVE-2026-113408)

A malicious server could exploit Git protocol v2 during the cloning of an empty repository. By sending a branch name containing path traversal sequences, a subsequent update to that branch could allow writing files outside Git’s designated reference folder.

Denial of Service from GPG Signatures (CVE-2026-114467)

Merging a tag with more than two GPG signatures could corrupt Git’s stack memory, leading to a denial-of-service condition. This could impact hosting services that perform such merges on behalf of users.

Out-of-Bounds Read in Binary Patches (CVE-2026-114469)

A specially crafted binary patch designed to expand to an extremely large size could bypass Git’s 1 GiB patch size limit, causing an out-of-bounds read and crashing the Git client.

Heap Corruption in Large Merges (CVE-2026-105437)

When performing very large merges with numerous conflicts and a substantial conflict-marker-size attribute, Git could write beyond the allocated buffer, leading to heap memory corruption. GitLab, which assigned this CVE, notes that code-hosting servers are particularly susceptible via git merge-tree operations, often performed during pull or merge request checks. A workaround involves setting conflict-marker-size=7 in each repository’s info/attributes file or disabling merge checks for untrusted repositories.

Arbitrary File Operations via git fast-import (CVE-2026-114466)

Three features within git fast-import (rewrite-submodules-from, rewrite-submodules-to, and export-pack-edges) could be abused to read arbitrary files or create and append data to files. Git now restricts these features in input streams unless the --allow-unsafe-features flag is explicitly set.

These patches collectively underscore the complex security landscape of widely used development tools. Staying updated is not just recommended; it’s essential for maintaining a secure development environment.

For more critical cybersecurity insights and exclusive content, follow us on Google News, Twitter, and LinkedIn.

For more details, visit our website.

Source: Link