Git Addresses Vulnerability Allowing Code Execution from Malicious Repositories

Git has released a fix for a vulnerability that could allow malicious repositories to execute code on computers that recursively clone them along with their submodules. This issue was addressed in Git version 2.56.1, with corresponding updates for earlier versions 2.50 through 2.55 in releases 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, and 2.55.1.

The vulnerability, identified as CVE-2026-111760, involves an integer truncation in how Git manages its index. An excessively long path in a repository can bypass Git’s safety checks, allowing it to be written to disk under a shorter name that an attacker can designate as .git.

This situation enables an attacker to replace a submodule’s .git file with a symbolic link to a directory containing malicious hooks or configurations. Hooks are scripts that Git executes at specific points, meaning that once Git accesses that directory, the attacker’s code can be executed.

The significance of submodules is highlighted by the fact that Git does not permit the replacement of a .git folder with a symbolic link. However, in a newly cloned submodule, .git is treated as a file.

The updated versions prevent such excessively long paths from being processed before their length can be truncated. Details of the releases can be found in the Git project’s release announcement.

GitHub, which incorporates Git into its tools, provided an explanation of the fixes in a detailed write-up. The company recommends users install a fixed version from their operating system or Git distributor and update any applications that include their own version of Git.

GitHub has already implemented these fixes on github.com and GitHub Enterprise Cloud. For GitHub Enterprise Server, the fixes are included in versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4.

Updates for GitHub Desktop and the GitHub Copilot app are currently being prepared, and GitHub Codespaces and GitHub Actions will also receive the updated Git.

As of November 10, Git for Windows had not yet released a version based on Git 2.56.1, according to a check of its release tags by The Hacker News.

Until users can install a fixed version, GitHub suggests several precautions:

• Clone only from trusted servers.
• Avoid recursively cloning untrusted repositories.
• Do not merge content or tags from untrusted sources.
• Refrain from processing binary patches or fast-import streams from untrusted origins.

The recent Git releases also address five additional vulnerabilities:

• CVE-2026-113408: Cloning an empty repository over Git protocol v2 can allow a malicious server to send a branch name that includes path traversal, potentially writing outside Git’s reference folder.
• CVE-2026-114467: Merging a tag with more than two GPG signatures can corrupt Git’s stack memory, leading to a denial of service.
• CVE-2026-114469: A binary patch that expands beyond Git’s patch size limit can cause Git to crash due to an out-of-bounds read.
• CVE-2026-105437: A large merge with numerous conflicts can lead Git to write past the end of a buffer, corrupting heap memory.
• CVE-2026-114466: Certain git fast-import features could be exploited to read arbitrary files or create files with added data, which Git now rejects unless the –allow-unsafe-features option is specified.

GitLab, which assigned CVE-2026-105437, noted that code-hosting servers are likely targets through the git merge-tree command, which may be used to verify whether a pull or merge request can be merged.

The conflict-marker-size attribute can be defined in a .gitattributes file within a repository. If a server reads these attributes, any user able to push branches and open pull or merge requests can trigger the vulnerability.

As a temporary workaround, servers unable to upgrade can set conflict-marker-size=7 in each repository’s info/attributes file or disable merge checks for untrusted repositories.

Source: The Hacker News