Git for Windows

Git Patches Integer Truncation Flaw CVE-2026-111760 Enabling Code Execution via Malicious Submodules in Recursive Clones

The Git project has released fixes for CVE-2026-111760, an integer truncation vulnerability in Git's index handling that allows a malicious repository to execute attacker-controlled code during recursive clones involving submodules. The flaw affects multiple Git versions and was addressed in Git 2.56.1 along with backported updates for the 2.50 through 2.55 series. An extremely long path can bypass safety checks and be truncated to target a .git file, which Git treats as a symlink in freshly cloned submodules, enabling malicious hooks to run. GitHub has applied the fixes to its platform and recommends immediate updates, while also detailing five additional vulnerabilities resolved in the same releases. GitLab highlighted risks to code-hosting servers through commands like git merge-tree. Workarounds include avoiding untrusted recursive clones and sources until patches are installed.