[Single source] Git fixes code execution in recursive clones

Git has released patched versions for a vulnerability reported as CVE-2026-111760. According to The Hacker News, a malicious repository could trigger attacker-controlled code when someone clones it recursively with its submodules. The listed fixes are Git 2.56.1, 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.[1]Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clonesthehackernews.com · rssOpen original sourceSee in source list

The report says the flaw involves integer truncation in Git's handling of its index. Its account links that condition to submodule hooks, which could be abused to execute code during a recursive clone of a crafted repository.[1]Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clonesthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

Cloning unfamiliar code is usually treated as obtaining files, not authorizing those files to run. If the reported path works as described, recursively fetching submodules could cross that boundary and expose the cloning computer to attacker-controlled execution.[1]Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clonesthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

Users and administrators should move to a fixed release in their current Git series. The evidence lists 2.56.1 and the maintenance releases 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1; environments that recursively clone untrusted repositories deserve priority.[1]Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clonesthehackernews.com · rssOpen original sourceSee in source list

The supplied material identifies the CVE, the reported recursive-clone scenario and seven patched Git releases. It does not establish whether exploitation has occurred in the wild, which operating systems or hosting services are affected, what prerequisites an exploit needs, or the identities and details of the five other vulnerabilities mentioned in the social post.[1]Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clonesthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

The Hacker News described the issue on X as a new Git flaw that lets malicious repositories execute code during recursive clones, attributing the path to submodule hooks. The post also said Git fixed this issue alongside five other vulnerabilities.[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

The article first presented the vulnerability, its CVE identifier and the patched release numbers. About a minute later, the outlet's X account condensed the finding into a warning focused on recursive clones, submodule hooks and the broader set of six fixes.[1]Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clonesthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

1 independent groups, 2 updates, and 0 engagements.

At a technical level, the report characterizes CVE-2026-111760 as integer truncation in Git's index handling, meaning a numeric value may be reduced in a way that changes its intended value. The social post says the resulting attack chain abuses submodule hooks, but the supplied excerpts do not show the exact malformed data, hook placement or execution sequence.[1]Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clonesthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

This account rests on one The Hacker News article excerpt and a matching post from the outlet's X account. They agree on the CVE, recursive-clone risk, submodule-hook angle and availability of fixes, but they are not independent corroboration and the supplied batch contains no Git advisory, patch diff or CVE record.[1]Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clonesthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list