Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5769 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Git Spawns Shell or Interpreter During Recursive Clone - CVE-2026-111760 Hook Execution

Behavioural detection of the CVE-2026-111760 outcome: a recursive clone (git clone --recurse-submodules) of a malicious repository replaces a submodule .git file with a symlink to attacker-controlled config or hooks, so git then runs a hook or config-defined command. Fires when git.exe, during clone/submodule/checkout, spawns a shell, downloader or scripting interpreter. Patched in Git 2.56.1 and backports.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1203, T1204
• Data sources: sysmon, windows_security, microsoft_defender_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ```CVE-2026-111760 recursive clone hook or config execution```
    (ParentImage="*\\git.exe" OR ParentImage="*\\git-remote-https.exe")
    (ParentCommandLine="*clone*" OR ParentCommandLine="*submodule*" OR ParentCommandLine="*checkout*" OR ParentCommandLine="*--recurse-submodules*")
    (Image="*\\sh.exe" OR Image="*\\bash.exe" OR Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\curl.exe" OR Image="*\\wget.exe" OR Image="*\\python.exe")
    NOT CommandLine="*git-lfs*"
| eval recursive_clone=if(like(ParentCommandLine,"%--recurse-submodules%") OR like(ParentCommandLine,"%--recursive%"),1,0)
| stats count min(_time) AS first_seen max(_time) AS last_seen max(recursive_clone) AS recursive_clone values(ParentCommandLine) AS git_command values(Image) AS child_images values(CommandLine) AS child_commands BY Computer User
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort -recursive_clone -count

Microsoft KQL

// CVE-2026-111760: git (clone / submodule / checkout) spawning a shell, downloader or interpreter
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("git.exe", "git", "git-remote-https.exe", "git-remote-https")
| where InitiatingProcessCommandLine has_any ("clone", "submodule", "checkout")
| where FileName in~ ("sh.exe", "bash.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wget.exe", "python.exe", "sh", "bash", "dash", "zsh", "curl", "wget", "python3")
| where ProcessCommandLine !has "git-lfs"
| extend RecursiveClone = InitiatingProcessCommandLine has_any ("--recurse-submodules", "--recursive")
| project Timestamp, DeviceName, AccountName, RecursiveClone, GitCommand = InitiatingProcessCommandLine, ChildImage = FileName, ChildCommand = ProcessCommandLine
| order by RecursiveClone desc, Timestamp desc

Sigma

title: Git Spawns Shell or Downloader During Clone Submodule or Checkout (CVE-2026-111760)
id: 6f1c2a3e-8b47-4d59-9a1e-3c5d7b2f4a10
status: experimental
description: Detects git spawning a shell, downloader or interpreter while cloning, updating submodules or checking out, the observable result of hook or config execution from a malicious recursive clone (CVE-2026-111760).
references:
  - https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr
  - https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111760
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1195.001
  - attack.t1203
  - attack.t1204
  - cve.2026-111760
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\git.exe'
      - '/git'
  selection_ctx:
    ParentCommandLine|contains:
      - ' clone '
      - 'submodule'
      - 'checkout'
      - '--recurse-submodules'
  selection_child:
    Image|endswith:
      - '\sh.exe'
      - '\bash.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\python.exe'
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python3'
  filter_lfs:
    CommandLine|contains: 'git-lfs'
  condition: all of selection_* and not filter_lfs
falsepositives:
  - Git for Windows aliases or hooks run by developers (pre-commit frameworks, Husky)
  - CI bootstrap scripts that legitimately run shell steps after clone
level: high

Known false positives:

• Developer hooks installed via pre-commit, Husky or lefthook that run shell steps after checkout
• CI/CD bootstrap scripts that call shells from git hooks on trusted repositories
• Git for Windows helper processes (sh.exe) used for aliases

Tuning notes: Exclude known CI service accounts and trusted internal repositories by Computer/User. Add git-lfs and other approved hook tools to the NOT filter. Prioritise rows with recursive_clone=1 and inspect the cloned repo for tracked hooks/ and config files. Patched Git (2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2) removes the exploit but the rule still flags malicious hook content.

• 🔒 Recursive Git Clone From Non-Allowlisted Host - CVE-2026-111760 Trigger Hunt · unlock with TL Creds
• 🔒 Download or Scripting Tool Spawned By Git Hook Script - Post-Exploitation After CVE-2026-111760 · unlock with TL Creds
• 🔒 Git Crash With Memory-Corruption Exception - CVE-2026-114467 CVE-2026-105437 CVE-2026-114469 · unlock with TL Creds
• 🔒 Git Ref or Symref Update With Path Traversal - CVE-2026-113408 · unlock with TL Creds
• 🔒 Git Executed With Command-Running [indicator] Keys - CVE-2026-111760 [indicator] Abuse · unlock with TL Creds
• 🔒 Git Fast-Import --allow-unsafe-features Override - CVE-2026-114466 Guard Bypass · unlock with TL Creds
• 🔒 Git Checkout Writes Hook Scripts Into hooks Directory - CVE-2026-111760 Payload Staging · unlock with TL Creds
• 🔒 Git Fast-Import Unsafe Features - CVE-2026-114466 Arbitrary File Read or Write · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 4 indicators of compromise for TL-2026-5769.

Technical analysis

Fixes ship in Git 2.56.1 with backports to 2.50.2; no in-the-wild exploitation or public PoC is reported.

CVE-2026-111760 (GHSA-vp2w-7xxj-jvxr, 'Recursive clones are susceptible to Remote Code Execution', CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, 8.0 High) is an integer truncation in Git's index handling. An overly long path passes the check that protects repository data from being overwritten, but is then written under a shorter, truncated name. An attacker-controlled repository can use this to overwrite a submodule's gitfile (the .git file) with a symbolic link to a directory holding malicious configuration or hooks, which Git may then execute with the victim's privileges. The Git team believes the issue is triggered only when --recurse-submodules is used. The fix rejects overly long index entry paths before their lengths can be truncated. The GHSA lists all versions as affected; the source does not give a finer-grained version range.

CVE-2026-113408 is a path traversal when cloning an empty repository over protocol v2: a malicious server can advertise a HEAD symref to an unborn branch whose name contains path-traversal components. Git did not validate that target, so with the files reference backend a later branch update can write outside the reference directory. Git now validates the advertised target and other ref names and symref targets received via protocol v2.

CVE-2026-114467 is stack corruption when stripping GPG signatures: Git assumed at most two signatures, so merging a tag carrying more than two signatures writes past the end of a fixed-size stack array (memory corruption, potential denial of service); hosting services that merge on users' behalf may be affected. CVE-2026-105437 is heap corruption during large merges: the result-size calculation can overflow (for example many conflicts combined with a large conflict-marker-size attribute), producing an undersized buffer and an out-of-bounds heap write; applications and hosting services merging untrusted content are affected. CVE-2026-114469 is an out-of-bounds read when applying crafted binary patches: the roughly 1 GiB limit was checked only against the supplied size, not the uncompressed size, so a small compressed patch can expand past it and crash Git. CVE-2026-114466 concerns git fast-import: rewrite-submodules-from and rewrite-submodules-to can read arbitrary files (contents potentially leaked via error messages) and export-pack-edges can create or append to files; these are now rejected from untrusted streams unless --allow-unsafe-features is passed. The release also adds overflow checks on related index entry allocations during checkout and tree processing (no CVE assigned).

Fixed versions are Git 2.56.1 and backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2, plus GitHub Enterprise Server 3.19.15, 3.20.11, 3.21.9 and 3.22.4. Fixes are deployed on github.com and GitHub Enterprise Cloud; patched builds are being coordinated for GitHub Desktop and the GitHub Copilot app, with Codespaces and Actions to receive patched Git. Applications bundling their own Git copy must be updated separately. The sources do not report in-the-wild exploitation or public PoC code for these six CVEs. The prior, separate Git flaw CVE-2025-48384 (symlink/submodule hook execution) was confirmed exploited by CISA per the press coverage, but is not one of these six.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools

Impact

T1499.004 Application or System Exploitation; T1565.001 Stored Data Manipulation

Remediation

Patches

• Git 2.56.1 and backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2
• GitHub Enterprise Server 3.19.15, 3.20.11, 3.21.9, 3.22.4

Immediate actions

• Update Git to 2.56.1 or the applicable backport (2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2)
• Update GitHub Enterprise Server to 3.19.15, 3.20.11, 3.21.9 or 3.22.4
• Inventory and update applications, CI runners and images that bundle their own Git copy

Workarounds

• Clone only from trusted servers and avoid recursive clones of untrusted repositories
• Avoid merging untrusted content or tags
• Avoid processing binary patches or fast-import streams from untrusted sources; use --allow-unsafe-features only with trusted streams

Longer-term hardening

• Restrict automated recursive clones (--recurse-submodules) to trusted sources in CI/CD and developer tooling
• Run Git operations on untrusted repositories in sandboxed, least-privilege environments
• Monitor for unexpected hooks or config reached through symlinks in cloned repositories

Affected and fixed versions

• Git — Git
  Vulnerable versions: All versions prior to the fixed releases (GHSA lists all versions for CVE-2026-111760)
  Fixed in: 2.56.1; 2.55.1; 2.54.1; 2.53.1; 2.52.1; 2.51.3; 2.50.2
• GitHub — GitHub Enterprise Server
  Vulnerable versions: Releases prior to the fixed versions
  Fixed in: 3.19.15; 3.20.11; 3.21.9; 3.22.4

Timeline

• 2026-11-10 GitLab work items 809, 810, 811, 812 and 814 track CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-2026-114466 and CVE-2026-105437 respectively.
• 2026-11-10 Fixes deployed on github.com, GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency; patched releases for GitHub Desktop and the Copilot app being coordinated, Codespaces and Actions to receive patched Git.
• 2026-11-10 GitHub Enterprise Server patched in 3.19.15, 3.20.11, 3.21.9 and 3.22.4.
• 2026-11-10 Git 2.56.1 released with backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2.
• 2026-11-10 GitHub Blog announces six Git vulnerabilities; GHSA-vp2w-7xxj-jvxr for CVE-2026-111760 (CVSS 8.0) published, crediting newren (remediation developer) and peff and dscho (reviewers).
• 2026-11-11 Cyber Security News reports the six fixes and notes no in-the-wild exploitation is stated; recalls prior CVE-2025-48384 as a separate CISA-confirmed exploited Git flaw.

Sources cited

• Git security vulnerabilities announced (GitHub Blog) github.blog · Advisory · 2026-11-10
• GHSA-vp2w-7xxj-jvxr: Recursive clones are susceptible to Remote Code Execution GitHub · Advisory · 2026-11-10
• NVD - CVE-2026-111760 NVD (NIST) · Research · 2026-11-10
• Git project repository (git/git) GitHub · Code repository · 2026-11-10
• Git security vulnerabilities announced (previous release, GitHub Blog) github.blog · Blog · 2025-07-08
• Git Fixes 6 Security Vulnerabilities Allowing Hackers to Execute Malicious Code Through Cloned Repositories cybersecuritynews.com · News · 2026-11-11

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)
• Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265)