Git Patches CVE-2026-111760: Malicious Repos Could Execute Code via Recursive Clones
evilsocket · x · 2026-11-11
Git fixed CVE-2026-111760, a flaw letting malicious repositories run attacker code during recursive clones with submodules. An integer truncation in index handling lets an extremely long path pass safety checks, then get written to disk under an attacker-chosen short name like .git, which can be swapped for a symlink to malicious hooks. Fixed in Git 2.56.1 plus 2.50.2–2.55.1 maintenance releases; GitHub has patched github.com and Enterprise Cloud, with Enterprise Server fixes in 3.19.15–3.22.4. Users should upgrade Git and any apps bundling it.
More from coding & agent
- 7 memory slots vs 200K tokens: the hardware mismatch behind AI coding debt — esrtweet · 2026-11-11
- Sydney Codex Community Buildathon set for Nov 14 with Cerebras-backed ultrafast compute track — paw_lean · 2026-11-11
- shadcn's improve hits 10k stars: let top models plan, cheap models execute code fixes — shadcn · 2026-11-11
- OpenAI open-sources Codex Security CLI and SDK for AI-driven vulnerability scanning and fixing — openai · 2026-11-11
- askmdb: fine-tuned Qwen models turn plain English into MongoDB queries, 0.8B hits 83.6% locally — AlternativeEnough352 · 2026-11-11
- Claude Opus 5.5 runs an architecture search and finds AttnRes-Canon, a new top Transformer design — SonglinYang4 · 2026-11-11