A vulnerability in Git, tracked as CVE-2026-111760, has been confirmed to allow code execution on systems that recursively clone malicious repositories. This flaw involves integer truncation in Git's index handling.
The vulnerability can be exploited by replacing a submodule's .git file with a symbolic link to a directory containing malicious hooks or configuration. This issue is triggered when using the --recurse-submodules option.
Git has released version 2.56.1 to address this vulnerability. Backports for versions 2.50 through 2.55 have also been made available to mitigate the risk.
GitHub has implemented the necessary fixes on github.com and GitHub Enterprise Cloud. Administrators are advised to update Git installations used by automation and services that process repositories.
GitHub recommends avoiding cloning repositories from untrusted sources until the fixed version of Git is installed.