Git released security updates on November 10 for six vulnerabilities, including a flaw that can execute attacker-controlled code when a user recursively clones a malicious repository.
The code-execution issue, CVE-2026-111760, involves path validation and submodule metadata. The project’s advisory says it currently believes exploitation requires --recurse-submodules and an attacker-hosted repository. The attack can reach malicious hooks or configuration during cloning.
The fixed releases are 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. Install the patched release for your maintenance branch or your distributor’s security update.
Check applications that bundle Git, plus CI runners and services that process repositories for other users. Updating a separate command-line installation does not establish that those copies are patched.
The remaining flaws concern reference path traversal, signature processing, binary patches, large merges and unsafe import features. Until updates are available, avoid recursive clones, merges, patches and import streams from untrusted sources. GitHub stresses that these precautions do not replace installing the fixes.
