Covered by 2 outlets — first reported by The Hacker News, Nov 10, 19:23 UTC
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
Summary
The Git project has released security updates for a flaw that lets a malicious repository run an attacker's code on a computer that clones it together with its submodules. The flaw, CVE-2026-111760, is an integer truncation in how Git handles its index, and the fix is in Git 2.56.1, with matching releases for the 2.50 through 2.55 series. The project's release also addresses five other vulnerabilities, covering code execution, writes to unintended files and memory corruption.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, Help Net Security. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules.
Help Net Security
Git fixes six vulnerabilities, including code execution during recursive clones
The Git project has released security updates addressing six vulnerabilities that could allow attackers to execute code, write to unintended files or cause memory corruption when Git processes malicious repositories or other specially…
Explained
The technology and terms in this story. Learn more