CVE-2026-111760

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.56.1 Git versions prior to 2.50.2 Git versions prior to 2.51.3 Git versions prior to 2.52.1 Git versions prior to 2.53.1 Git versions prior to 2.54.1 Git versions prior to 2.55.1

Description An index integer truncation issue allows malicious repositories to execute arbitrary code on a user's machine during recursive submodule clones. An extremely long path in an index triggers the truncation, enabling an attacker to overwrite a submodule's .git file with a symlink pointing to malicious hooks or configuration. Arbitrary code execution occurs automatically when Git triggers these attacker-controlled hooks during a standard recursive checkout. This can be exploited on developer hosts and CI/CD runners to harvest pipeline credentials and gain access to connected cloud environments.

Recommendations Upgrade Git to version 2.56.1. Upgrade Git to version 2.50.2. Upgrade Git to version 2.51.3 Upgrade Git to version 2.52.1 Upgrade Git to version 2.53.1 Upgrade Git to version 2.54.1 Upgrade Git to version 2.55.1 Avoid running recursive clones on untrusted repositories.