CVE-2026-111760: Git Recursive Clone RCE Flaw

# CVE-2026-111760: Git Recursive Clone RCE Flaw

https://gcdradar.vercel.app/incidents/cve-2026-111760-git-recursive-clone-rce-flaw · AIR-2026-1866 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability with a vendor patch and no known exploitation.
- Fix status: Patched
- First reported: 2026-11-10
- AI role: No AI role
- Products: Git
- CVE ids: CVE-2026-111760

## Summary

A flaw in Git allows malicious repositories to execute code during recursive submodule clones due to integer truncation. The Git project released patches across multiple versions to address the vulnerability.

## What to do

Update Git to version 2.56.1 or the corresponding patched version for your series.

## Affected and fixed versions

- Affected: Git 2.50 to 2.55
- Fixed in: Git 2.50.2
- Fixed in: 2.51.3
- Fixed in: 2.52.1
- Fixed in: 2.53.1
- Fixed in: 2.54.1
- Fixed in: 2.55.1
- Fixed in: 2.56.1

## Latest updates

- 2026-11-10: Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones (https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html)

## Sources

- 2026-11-10 The Hacker News: Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html
- 2026-11-11 Help Net Security: Git fixes six vulnerabilities, including code execution during recursive clones https://helpnetsecurity.com/2026/11/11/git-project-security-updates

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.