# Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

Source: [The Hacker News](https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html) · 2026-11-10 · Security
Page: https://themorning.dev/story/git-patches-flaw-that-lets-malicious-repositories-execute-code-during-recursive-b86930e18372a4de
Kind: security · Impact: high

## In brief

- The Git project released new versions fixing six security vulnerabilities, announced 2026-11-10.
- One flaw allows arbitrary code execution when a computer recursively clones a malicious repository and its submodules.
- Other flaws cause writes to unintended files and memory corruption when processing merges or binary patches.

## Why it matters

Developers who clone untrusted repositories recursively, including their submodules, can have attacker code run on their machine. Updating Git to a fixed release closes these flaws.

## What to do

- Upgrade Git to the patched release: Git 2.56.1, or the matching fix release for your 2.50–2.55 series (2.50.2, 2.51.3, 2.52.1, 2.53.1).

## Versions

- Git 2.56.1
- Git 2.50.2
- Git 2.51.3
- Git 2.52.1
- Git 2.53.1

## Timeline

- 2026-11-10: Git project announces six security vulnerabilities and releases fixed versions

## Coverage

- [Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones](https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html) — The Hacker News, 2026-11-10
- [Git security vulnerabilities announced](https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/) — The GitHub Blog, 2026-11-10

Tags: git, security, vulnerability, code-execution, submodules, version-control

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev