# Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)

> On 2026-11-10 the Git project and GitHub announced fixes for six vulnerabilities in Git, led by CVE-2026-111760 (CVSS 8.0), an integer truncation flaw that lets a malicious repository replace a submodule's .git file with a symlink to attacker-controlled config or hooks during a recursive clone. Fixes ship in Git 2.56.1 with backports to 2.50.2; no in-the-wild exploitation or public PoC is reported.

- **Published:** 2026-11-11T13:27:49Z
- **Last reviewed:** 2026-11-11T13:27:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5769
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5769.png
- **ID:** TL-2026-5769
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 4
- **CVEs:** CVE-2026-111760, CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-2026-105437, CVE-2026-114466

## Description

CVE-2026-111760 (GHSA-vp2w-7xxj-jvxr, 'Recursive clones are susceptible to Remote Code Execution', CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, 8.0 High) is an integer truncation in Git's index handling. An overly long path passes the check that protects repository data from being overwritten, but is then written under a shorter, truncated name. An attacker-controlled repository can use this to overwrite a submodule's gitfile (the .git file) with a symbolic link to a directory holding malicious configuration or hooks, which Git may then execute with the victim's privileges. The Git team believes the issue is triggered only when --recurse-submodules is used. The fix rejects overly long index entry paths before their lengths can be truncated. The GHSA lists all versions as affected; the source does not give a finer-grained version range.

CVE-2026-113408 is a path traversal when cloning an empty repository over protocol v2: a malicious server can advertise a HEAD symref to an unborn branch whose name contains path-traversal components. Git did not validate that target, so with the files reference backend a later branch update can write outside the reference directory. Git now validates the advertised target and other ref names and symref targets received via protocol v2.

CVE-2026-114467 is stack corruption when stripping GPG signatures: Git assumed at most two signatures, so merging a tag carrying more than two signatures writes past the end of a fixed-size stack array (memory corruption, potential denial of service); hosting services that merge on users' behalf may be affected. CVE-2026-105437 is heap corruption during large merges: the result-size calculation can overflow (for example many conflicts combined with a large conflict-marker-size attribute), producing an undersized buffer and an out-of-bounds heap write; applications and hosting services merging untrusted content are affected. CVE-2026-114469 is an out-of-bounds read when applying crafted binary patches: the roughly 1 GiB limit was checked only against the supplied size, not the uncompressed size, so a small compressed patch can expand past it and crash Git. CVE-2026-114466 concerns git fast-import: rewrite-submodules-from and rewrite-submodules-to can read arbitrary files (contents potentially leaked via error messages) and export-pack-edges can create or append to files; these are now rejected from untrusted streams unless --allow-unsafe-features is passed. The release also adds overflow checks on related index entry allocations during checkout and tree processing (no CVE assigned).

Fixed versions are Git 2.56.1 and backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2, plus GitHub Enterprise Server 3.19.15, 3.20.11, 3.21.9 and 3.22.4. Fixes are deployed on github.com and GitHub Enterprise Cloud; patched builds are being coordinated for GitHub Desktop and the GitHub Copilot app, with Codespaces and Actions to receive patched Git. Applications bundling their own Git copy must be updated separately. The sources do not report in-the-wild exploitation or public PoC code for these six CVEs. The prior, separate Git flaw CVE-2025-48384 (symlink/submodule hook execution) was confirmed exploited by CISA per the press coverage, but is not one of these six.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1005 Data from Local System
- T1499.004 Application or System Exploitation
- T1565.001 Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Git Spawns Shell or Interpreter During Recursive Clone - CVE-2026-111760 Hook Execution** (`TL-2026-5769-SPL-001`)

Behavioural detection of the CVE-2026-111760 outcome: a recursive clone (git clone --recurse-submodules) of a malicious repository replaces a submodule .git file with a symlink to attacker-controlled config or hooks, so git then runs a hook or config-defined command. Fires when git.exe, during clone/submodule/checkout, spawns a shell, downloader or scripting interpreter. Patched in Git 2.56.1 and backports.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1203, T1204
- **Data sources:** sysmon, windows_security, microsoft_defender_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ```CVE-2026-111760 recursive clone hook or config execution```
    (ParentImage="*\\git.exe" OR ParentImage="*\\git-remote-https.exe")
    (ParentCommandLine="*clone*" OR ParentCommandLine="*submodule*" OR ParentCommandLine="*checkout*" OR ParentCommandLine="*--recurse-submodules*")
    (Image="*\\sh.exe" OR Image="*\\bash.exe" OR Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\curl.exe" OR Image="*\\wget.exe" OR Image="*\\python.exe")
    NOT CommandLine="*git-lfs*"
| eval recursive_clone=if(like(ParentCommandLine,"%--recurse-submodules%") OR like(ParentCommandLine,"%--recursive%"),1,0)
| stats count min(_time) AS first_seen max(_time) AS last_seen max(recursive_clone) AS recursive_clone values(ParentCommandLine) AS git_command values(Image) AS child_images values(CommandLine) AS child_commands BY Computer User
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort -recursive_clone -count
````

### Microsoft KQL

```kql
// CVE-2026-111760: git (clone / submodule / checkout) spawning a shell, downloader or interpreter
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("git.exe", "git", "git-remote-https.exe", "git-remote-https")
| where InitiatingProcessCommandLine has_any ("clone", "submodule", "checkout")
| where FileName in~ ("sh.exe", "bash.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wget.exe", "python.exe", "sh", "bash", "dash", "zsh", "curl", "wget", "python3")
| where ProcessCommandLine !has "git-lfs"
| extend RecursiveClone = InitiatingProcessCommandLine has_any ("--recurse-submodules", "--recursive")
| project Timestamp, DeviceName, AccountName, RecursiveClone, GitCommand = InitiatingProcessCommandLine, ChildImage = FileName, ChildCommand = ProcessCommandLine
| order by RecursiveClone desc, Timestamp desc
```

### Sigma

```yaml
title: Git Spawns Shell or Downloader During Clone Submodule or Checkout (CVE-2026-111760)
id: 6f1c2a3e-8b47-4d59-9a1e-3c5d7b2f4a10
status: experimental
description: Detects git spawning a shell, downloader or interpreter while cloning, updating submodules or checking out, the observable result of hook or config execution from a malicious recursive clone (CVE-2026-111760).
references:
  - https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr
  - https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111760
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1195.001
  - attack.t1203
  - attack.t1204
  - cve.2026-111760
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\git.exe'
      - '/git'
  selection_ctx:
    ParentCommandLine|contains:
      - ' clone '
      - 'submodule'
      - 'checkout'
      - '--recurse-submodules'
  selection_child:
    Image|endswith:
      - '\sh.exe'
      - '\bash.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\python.exe'
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python3'
  filter_lfs:
    CommandLine|contains: 'git-lfs'
  condition: all of selection_* and not filter_lfs
falsepositives:
  - Git for Windows aliases or hooks run by developers (pre-commit frameworks, Husky)
  - CI bootstrap scripts that legitimately run shell steps after clone
level: high

```

**Known false positives:**

- Developer hooks installed via pre-commit, Husky or lefthook that run shell steps after checkout
- CI/CD bootstrap scripts that call shells from git hooks on trusted repositories
- Git for Windows helper processes (sh.exe) used for aliases

**Tuning notes:** Exclude known CI service accounts and trusted internal repositories by Computer/User. Add git-lfs and other approved hook tools to the NOT filter. Prioritise rows with recursive_clone=1 and inspect the cloned repo for tracked hooks/ and config files. Patched Git (2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2) removes the exploit but the rule still flags malicious hook content.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Recursive Git Clone From Non-Allowlisted Host - CVE-2026-111760 Trigger Hunt (locked: unlock with TL Creds)
- Download or Scripting Tool Spawned By Git Hook Script - Post-Exploitation After CVE-2026-111760 (locked: unlock with TL Creds)
- Git Crash With Memory-Corruption Exception - CVE-2026-114467 CVE-2026-105437 CVE-2026-114469 (locked: unlock with TL Creds)
- Git Ref or Symref Update With Path Traversal - CVE-2026-113408 (locked: unlock with TL Creds)
- Git Executed With Command-Running [indicator] Keys - CVE-2026-111760 [indicator] Abuse (locked: unlock with TL Creds)
- Git Fast-Import --allow-unsafe-features Override - CVE-2026-114466 Guard Bypass (locked: unlock with TL Creds)
- Git Checkout Writes Hook Scripts Into hooks Directory - CVE-2026-111760 Payload Staging (locked: unlock with TL Creds)
- Git Fast-Import Unsafe Features - CVE-2026-114466 Arbitrary File Read or Write (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Git security vulnerabilities announced (GitHub Blog)](https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/)
- [GHSA-vp2w-7xxj-jvxr: Recursive clones are susceptible to Remote Code Execution](https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr)
- [Git Fixes 6 Security Vulnerabilities Allowing Hackers to Execute Malicious Code Through Cloned Repositories](https://cybersecuritynews.com/git-fixes-security-vulnerabilities/)
- [NVD - CVE-2026-111760](https://nvd.nist.gov/vuln/detail/CVE-2026-111760)
- [Git project repository (git/git)](https://github.com/git/git)
- [Git security vulnerabilities announced (previous release, GitHub Blog)](https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5769