Git has released updates for version 2.56.1 and the 2.50-2.55 series, patching six security flaws including CVE-2026-111760.
The primary vulnerability allowed code execution through malicious repositories during recursive cloning due to improper file path handling.
Review the patch details and update your environments.
How the basic problem worked
The most serious flaw allows someone to run malicious code on your computer through the process of “cloning” a code repository. The problem occurs when Git encounters files with extremely long pathnames, allowing an attacker to overwrite system files. This is especially true for those who perform recursive cloning, which is downloading a project along with all its supporting parts.
Additional vulnerabilities
In addition to the main issue, the new versions fix five other security issues found in the software. These vulnerabilities could potentially allow malicious servers to write files to the wrong places, cause problems with the program's operation, or expose files that should remain protected.
What users should know
- Update: Users should upgrade Git to the latest version. Note that as of November 10, 2026, Git for Windows had not yet received this update.
- Platforms: GitHub has already implemented the necessary fixes to its infrastructure, while updates are also being prepared for GitHub Desktop and GitHub Copilot.
- Pay attention to the sources: Until you install the fixes, it is recommended that you avoid cloning repositories that come from sources that you do not fully trust.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
