Git Vulnerability CVE-2026-111760: Recursive Clone Can Execute Attacker Code, Check Version and Update Now

CVE-2026-111760 is a vulnerability in Git that allows a malicious repository to run attacker code on a victim's computer, simply when the victim performs a recursive clone and its submodules. This flaw was patched on November 10, 2026 via Git 2.56.1 and backports 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, and 2.55.1, with a CVSS 3.1 score of 8.0 (High).

What makes it important: git clone --recurse-submodules are everyday developer commands, CI pipelines, and tools that bundle Git itself. The same release also patches five other vulnerabilities, including one that targets code hosting servers. This article discusses how the flaw works, who is affected, safe versions, how to check your machine, temporary mitigations, and how to look for traces of suspicious submodules.

Quick summary: what do you need to know?

How does this loophole work?

Git stores a list of tracked files in index. According to The Hacker News, this flaw takes the form of integer truncation in index handling: very long paths in a repository can pass Git security checks, but are then written to disk with shorter names. An attacker could set the short name to .git.

This vulnerability is dangerous because of the behavior of submodules. Git refuses to replace folder .git with a symbolic link, but in the newly cloned submodule, .git is a file (gitfile). Git's release notes explain that Git can be tricked into overwriting the submodule's gitfile with symlinks pointing to folders containing malicious config or hooks. A hook is a program that Git runs at a certain point, so once Git uses that folder, the attacker's code can run.

The patched version rejects paths that are too long before the length can be truncated. The release notes also list an additional fix (defense-in-depth) in read-cache that rejects cache entries with names that are too long.

Why is the score "only" 8.0?

The CVSS vector in the Git advisory indicates several conditions: high attack complexity (AC:H), low access privileges required (PR:L), and victim interaction required (UI:R), i.e. the victim must clone the repository recursively. However, the scope changes (S:C) with a high impact on confidentiality, integrity and availability. The advisory also states that the malicious repository was hosted by the attacker himself, not on a regular forum, and is currently believed to only be triggered with option --recurse-submodules.

Who is affected?

• Developers who use Git versions below the repair release and have or often perform recursive clones, including via project setup scripts.
• CI/CD pipeline and build server that clones third-party repositories and their submodules automatically.
• Applications that bundle their own copy of Git. GitHub specifically recommends updating such applications, as Git updates from the operating system do not update them.
• Windows users: as of November 10 at 19:09 UTC, The Hacker News notes Git for Windows has not yet released a 2.56.1-based version.
• GitHub Enterprise Server users who have not yet upgraded to 3.19.15, 3.20.11, 3.21.9, or 3.22.4.

Github.com and GitHub Enterprise Cloud users are already patched on the server side by GitHub. But the main loophole occurs in the clone client 's Git, so Git on your laptop and runner still needs to be updated.

How serious is the situation?

• Junio ​​C Hamano's Git release announcement on November 10, 2026 called it "a set of coordinated security fix releases" and asked users to update ASAP.
• One release patches six CVEs: CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469, and CVE-2026-105437.
• GitHub is preparing new versions of GitHub Desktop and the GitHub Copilot app, and Codespaces and GitHub Actions will also get Git improvements.
• The sources we read have not reported any real-world exploits or public PoCs for CVE-2026-111760.

One note: when we opened it, the GHSA-vp2w-7xxj-jvxr advisory page still said "Patched versions: none" and "Patches are being discussed". The content doesn't appear to have been updated, as the official Git release notes already list CVE-2026-111760 as fixed. Hold the release notes as a reference for the safe version.

Five other gaps in the same release

Which version is safe?

How to check Git version?

# Versi Git yang dipakai di terminal
git --version

# Lokasi binary Git (bisa lebih dari satu di PATH)
which -a git

# Apakah clone/pull otomatis memakai submodule? (true = rekursif secara default)
git config --show-origin --get submodule.recurse

# Cari salinan Git lain yang dibundel aplikasi (contoh di Linux/macOS)
find / -type f -name git -perm -u+x 2>/dev/null | grep -v '^/proc' | head -50

In the CI runner, add git --version to the beginning of the job so that the version actually used is recorded in the log. Note that self-hosted container images and runners often carry older versions of Git.

How to update safely?

Recommended sequence: stop recursive clones from untrusted sources first, then update Git on all machines.

Step 1: temporary mitigation

GitHub recommends the following steps until a fixed version is installed, and emphasizes that these steps do not replace patches: clone only from trusted servers, do not recursively clone untrusted repositories, do not merge untrusted content or tags, and do not process patch binaries or fast-import streams from untrusted sources.

# Pastikan clone tidak otomatis rekursif (hapus jika pernah di-set true)
git config --global --unset submodule.recurse

# Untuk repositori yang belum dipercaya: clone TANPA submodule dulu
git clone https://contoh.domain/repo.git
cd repo

# Periksa daftar submodule sebelum mengambilnya
cat .gitmodules
git submodule status

For code hosting servers that can't be upgraded yet, The Hacker News cites workaround CVE-2026-105437: add conflict-marker-size=7 to file info/attributes per repository, or turn off merge checking for untrusted repositories.

# Contoh untuk repositori bare di server (sesuaikan path)
echo '* conflict-marker-size=7' >> /path/ke/repo.git/info/attributes

Step 2: update and verify

GitHub recommends installing a repaired version of your operating system or Git distributor. Packages in each distro can be published at different times, so check the version after updating.

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade git

# RHEL/Rocky/AlmaLinux/Fedora
sudo dnf upgrade git

# macOS (Homebrew)
brew update && brew upgrade git

# Verifikasi: harus 2.56.1 atau versi backport yang sesuai cabang
git --version

On Windows, monitor the 2.56.1-based Git for Windows release, then run git update-git-for-windows or download the official installer. Also update GitHub Desktop and other applications that bundle Git as new versions come out.

How to detect suspicious repositories?

There is no published IOC for this gap yet. What can be checked are the characteristics of the attack technique: gitfile submodules that turn into symlinks, as well as unknown hooks or config. Run it from the recursive clone repository folder.

# 1) Normalnya .git di dalam submodule adalah FILE biasa, bukan symlink
find . -name .git -type l -exec ls -l {} \;

# 2) Hook aktif (selain contoh *.sample) di repositori utama dan submodule
find .git/hooks .git/modules -path '*hooks/*' ! -name '*.sample' -type f 2>/dev/null

# 3) core.hooksPath atau konfigurasi lain yang mengarah ke folder tak dikenal
git config --show-origin --get-regexp 'core\.hookspath|core\.fsmonitor|core\.sshcommand'
git submodule foreach --recursive 'git config --show-origin --get-regexp "core\..*" || true'

# 4) Path yang sangat panjang di index (pemicu celah)
git ls-files | awk 'length($0) > 4096 {print length($0)": "substr($0,1,80)"..."}'

A blank result in steps 1 through 3 is normal for most projects. One finding alone isn't necessarily an attack, but symlink .git in a submodule or hook that you didn't install yourself is worth serious inspection.

If you find signs of a burglary?

1. Disconnect the machine from the network and keep a copy of the repository folder, including .git/modules, as evidence.
2. Check the running processes and the new cron/systemd timer on the machine.
3. Rotate credentials stored on the machine: SSH keys, Git hosting tokens, credential helpers, cloud tokens, and CI secrets.
4. Rebuild the runner or workstation from a clean image with a secure version of Git.
5. Report the source repository to the relevant hosting platform.

Frequently asked questions

I only use github.com. Does it need updating?

Yes. GitHub already patched the github.com server, but the main gap occurred in the Git client when cloning. Git on your laptop, server, and runner should still be updated.

Is plain git clone without submodules safe?

Git Advisory currently believes this vulnerability can only be triggered with --recurse-submodules. But the same release also patches other vulnerabilities that don't require submodules, for example CVE-2026-113408 when cloning an empty repository, so an update is still mandatory.

Has this gap entered CISA KEV?

The sources we read didn't mention it. The latest KEV news (November 10, 2026) discusses Cisco BroadWorks and Openwave, not Git. Status may change, so keep an eye on the KEV catalogue.

What about VPS or shared hosting in Indonesia?

If you have SSH access and are using Git on the server for deployment, check the version with git --version and update via the distro package. On shared hosting, Git is managed by the provider, so ask them for the update schedule and avoid recursive cloning of third-party repositories until Git is updated.

Is GitHub Actions runner safe?

GitHub says Actions will get a Git fix. For self-hosted runners, you yourself must update Git on the runner machine.

This flaw adds to the list of security issues in the developer supply chain after the GitLab flaw CVE-2026-97229. The pattern is similar: the tools we use every day to capture and build code become a pathway to attack. For Linux servers, also check the status of the kernel vulnerability CVE-2026-98432.

Source

• Git mailing list: [ANNOUNCE] Git 2.56.1 and friends (official release notes)
• GitHub Security Advisory GHSA-vp2w-7xxj-jvxr: Recursive clones are susceptible to Remote Code Execution
• GitHub Blog: Git security vulnerabilities announced
• The Hacker News: Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
• The Hacker News: Cisco BroadWorks and Openwave Flaws Actively Exploited (KEV news November 10, 2026)