Security · High impactFan score 43 · Tier B2 sources
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
The Hacker News ·
The Brief · written from 2 sources
- The Git project released new versions fixing six security vulnerabilities, announced 2026-11-10.
- One flaw allows arbitrary code execution when a computer recursively clones a malicious repository and its submodules.
- Other flaws cause writes to unintended files and memory corruption when processing merges or binary patches.
Why it matters
Developers who clone untrusted repositories recursively, including their submodules, can have attacker code run on their machine. Updating Git to a fixed release closes these flaws.
Who’s affected
- Developers who run recursive clones of untrusted repositories
- Anyone running an affected Git version
What to do
- Upgrade Git to the patched release: Git 2.56.1, or the matching fix release for your 2.50–2.55 series (2.50.2, 2.51.3, 2.52.1, 2.53.1).
- Git 2.56.1
- Git 2.50.2
- Git 2.51.3
- Git 2.52.1
- Git 2.53.1
- #git
- #security
- #vulnerability
- #code-execution
- #submodules
- #version-control
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1…
Timeline
Git project announces six security vulnerabilities and releases fixed versions
The GitHub Blog
Git security vulnerabilities announced
The Hacker News
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
Full coverage · 2 sources
- 2h ago ↗
The Hacker News
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
- 4h ago ↗
The GitHub Blog
Git security vulnerabilities announced