CybersecurityUpdated Yesterday

Git patches six flaws, including a recursive-clone code-execution risk

Git 2.56.1 fixes six vulnerabilities, including CVE-2026-111760. A malicious repository could exploit an integer-truncation bug in Git’s index handling during a recursive clone: an unusually long path can pass validation under one name, then be written under a shorter one. That could let the repository replace a submodule’s .git file with a symbolic link to malicious configuration or hooks. When Git uses that directory, attacker-controlled code could run. The fix rejects extremely long index paths before their lengths can be truncated. Fixes are also backported to Git 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. Install 2.56.1 or the patched release for your maintenance series, and update apps that bundle Git.

2 publishers2 reports

Coverage started Yesterday