MicrosoftAnalysisGit patches recursive submodule arbitrary code execution flaw across all versions
What happened.The Git project and GitHub released coordinated maintenance updates fixing six vulnerabilities headed by an integer truncation code execution flaw.
Why it matters.Engineering teams clone external repositories daily during normal development and automated builds. When recursive submodule checkout triggers arbitrary code execution, attackers compromise developer workstations and build runners. Engineering teams must upgrade local Git tools and continuous integration container images immediately.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-111760, an integer truncation bug in index path handling lets deeply nested paths bypass sanitization checks.
- Submodule exploitation: Attackers substitute a submodule git directory file with a symbolic link pointing to a malicious directory containing hook scripts.
- Execution vector: When developers recursively clone an untrusted repository, Git follows the link and executes arbitrary commands during checkout.
- Protocol vulnerabilities: The release also fixes CVE-2026-113408, a path traversal defect triggered through advertised symbolic references over Git protocol v2.
- Remediation releases: Patches shipped in Git 2.56.1 and backported across maintenance branches 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2.