---
id: 2026-11-git-2-56-1-recursive-clone-code-execution-cve-2026-111760-six-cves
title: "Git 2.56.1 and six backports fix code execution on recursive clone (CVE-2026-111760) and five more CVEs; update every bundled Git"
date_disclosed: 2026-11-10
last_updated: 2026-11-11
severity: high
status: patched
ecosystems: [git, github, developer-tools, ci-cd, coding-agents]
tools_affected: ["Git before 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2", "any application that ships its own copy of Git: GitHub Desktop, the GitHub Copilot app, IDEs, coding agents and their sandboxes, CI images", "Git for Windows (no release based on 2.56.1 at 19:09 UTC on 2026-11-10, per The Hacker News)", "GitHub Enterprise Server before 3.19.15, 3.20.11, 3.21.9 and 3.22.4", "servers that merge untrusted branches (CVE-2026-105437)"]
tags: [cve, git, recursive-clone, submodules, code-execution, path-traversal, fast-import, bundled-git, coding-agents, cve-record-not-yet-published]
---

## TL;DR
GitHub announced Git 2.56.1 on 2026-11-10 with backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. They fix six CVEs. The one that matters most to this audience is CVE-2026-111760: cloning a malicious repository with `--recurse-submodules` can run the repository author's code on the cloning machine. Update Git, then update every application that bundles its own Git. Until then, do not recursively clone a repository you do not trust, and do not let a coding agent do it for you. CVE Services had no record for the three ids this sweep queried (CVE-2026-111760, CVE-2026-113408, CVE-2026-114466) on 2026-11-11, so scanners keyed to CVE records will not flag an old Git yet.

## What happened

GitHub's announcement (Elijah Newren, 2026-11-10) lists the six CVEs and the fixed releases. It gives no affected ranges and no reporter credits. The Hacker News article of the same day adds detail it attributes to the Git project's mailing-list announcement, which this sweep did not open.

| CVE | What GitHub's post says | Who is exposed |
|---|---|---|
| CVE-2026-111760 | Code execution during recursive clones, from an integer truncation in index path handling | anyone who runs `git clone --recurse-submodules` on an untrusted repository |
| CVE-2026-113408 | Path traversal through a server's advertised HEAD symref, which can write outside the reference directory | anyone who clones from an untrusted server |
| CVE-2026-114467 | Stack corruption when stripping GPG signatures from messages with more than two signatures | anyone, or any service, that merges untrusted tags |
| CVE-2026-114469 | Out-of-bounds read when applying binary patches, because the size check ignored the decompressed size | anyone who applies untrusted binary patches |
| CVE-2026-105437 | Heap corruption from an integer overflow in a memory calculation during large merges | servers that merge untrusted branches |
| CVE-2026-114466 | Filesystem access through `git fast-import` features `rewrite-submodules-from`, `rewrite-submodules-to` and `export-pack-edges` | anyone who feeds untrusted streams to `git fast-import` |

The Hacker News adds, as its account of the announcement: CVE-2026-105437 was assigned by GitLab and has a workaround of `conflict-marker-size=7` in each repository's `info/attributes`. Git now rejects the three fast-import features unless `--allow-unsafe-features` is set. No CVSS score is printed by either source, and this file states none.

**Where the fix has and has not landed, as stated on 2026-11-10.**

- github.com, GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency: fixes deployed, per GitHub.
- GitHub Enterprise Server: fixed in 3.19.15, 3.20.11, 3.21.9 and 3.22.4, per GitHub.
- GitHub Desktop and the GitHub Copilot app: releases with patched Git "are being coordinated", per GitHub. No version is named.
- GitHub Codespaces and GitHub Actions: "will receive" patched Git, per GitHub. No date is named.
- Git for Windows: The Hacker News checked the release tags at 19:09 UTC on 2026-11-10 and found no release based on 2.56.1. This sweep did not re-check.

**Why it is here.** Coding agents clone repositories as a routine step: to read a dependency, to reproduce an issue, to follow a README. A prompt or an issue that says "clone this with submodules" is enough to reach CVE-2026-111760 on an unpatched Git. Agents, IDEs and sandboxes often carry their own Git binary that the operating system's package manager never updates. This is the same exposure as the [git-config agent cluster](2026-09-gitspawn-git-config-agent-rce-cluster.md), reached through a different Git feature.

## Am I affected?

1. **System Git.** `git --version`. Fixed versions are 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. Neither source gives a lower bound, so treat every earlier version as affected. A series older than 2.50 has no listed backport.
2. **Bundled Git.** Find the copies your tools ship: `find / -type f \( -name git -o -name git.exe \) 2>/dev/null`, then run `--version` on each. Check GitHub Desktop, IDE installs, agent sandboxes, container images and CI runner images.
3. **CI.** In a pipeline step, print `git --version` on the runner. Hosted runners change when the provider updates the image, not when you do.
4. **Habits.** Search scripts, CI config and agent instructions for `--recurse-submodules`, `--recursive` and `submodule update --init` run against repositories you do not control.

## If you are affected

- Upgrade Git to a fixed release for your series. Rebuild container and CI images that pin an older Git.
- Update applications that bundle Git when their vendors ship a fixed build. Until then, point them at the system Git where the application allows it.
- If you cannot upgrade yet, follow GitHub's interim advice: clone only from trusted servers, avoid recursive clones of untrusted repositories, avoid merging untrusted content or tags, and avoid processing binary patches or fast-import streams from untrusted sources. GitHub says these do not replace the fix.
- If an unpatched machine recursively cloned a repository you now distrust, treat it as code execution under that user. [If your local AI agent was exploited](../playbooks/if-your-local-ai-agent-was-exploited.md) covers host triage and [rotating cloud credentials](../playbooks/rotating-cloud-credentials.md) covers the order of rotation.

## Prevention

- **Clone untrusted code inside a sandbox with no credentials.** [Agent sandboxing](../prevention/agent-sandboxing.md) covers running an agent's clone, install and build steps away from your keys.
- **Do not let an agent choose clone flags for a repository it found.** Require approval for `git clone` of a new origin and for any submodule operation.
- **Inventory bundled Git.** The copy that matters is the one the tool runs, not the one on your `PATH`.

## Sources

- [GitHub Blog: Git security vulnerabilities announced](https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/), fetched 2026-11-11: dated 2026-11-10, Elijah Newren; the six CVE ids and one-line descriptions; fixed releases; GitHub product status; interim precautions. No affected ranges and no reporter credits on the page.
- [The Hacker News: Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones](https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html), fetched 2026-11-11: dated 2026-11-10; the GitLab assignment and workaround for CVE-2026-105437, the `--allow-unsafe-features` change, and the Git for Windows check at 19:09 UTC. Outlet coverage of the same announcement, not an independent finding.
- CVE Services (`cveawg.mitre.org/api/cve/CVE-2026-111760`, not linked because it returns 404), queried 2026-11-11: `CVE_RECORD_DNE`. The same answer came back for CVE-2026-113408 and CVE-2026-114466. The other three ids were not queried.
- Not opened: the Git mailing-list announcement on `lore.kernel.org` and the per-CVE advisory pages GitHub's post links. The vendor post is the single primary for this file.