PT-2026-144997
CVE-2026-114466
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Git has patched 6 security vulnerabilities, including a high-severity flaw that allows malicious repositories to execute attacker-controlled code during recursive clones.
The six CVEs:
- CVE-2026-111760: Remote code execution through malicious submodules.
- CVE-2026-113408: Path traversal through malicious HEAD references.
- CVE-2026-114467: Stack memory corruption when processing GPG signatures.
- CVE-2026-114469: Out-of-bounds reads through malicious binary patches.
- CVE-2026-105437: Heap memory corruption during merges.
- CVE-2026-114466: Arbitrary file reads and writes through Git fast-import.
Fixed versions: Git 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2.
Update Git and check applications that bundle their own Git binaries.
A repository clone is not automatically a safe operation.
Found an issue in the description? Have something to add? Feel free to write us 👾