{"slug":"git-recursive-clone-rce-cve-2026-111760","title":"Git recursive clone RCE (CVE-2026-111760)","shortName":"Git recursive clone","seoTitle":"Git recursive clone (CVE-2026-111760): versions, exploitation & detection","summary":"No known in-the-wild use as of 10 Nov 2026. Integer truncation in Git index path handling can let a malicious repository load attacker-controlled hooks during a recursive clone (CVE-2026-111760, git/git GHSA-vp2w-7xxj-jvxr CVSS 3.1 8.0). Precondition: the victim (developer, CI job, or server automation) recursively clones an attacker-controlled repo. GitHub currently believes this needs --recurse-submodules. Fixed in Git 2.56.1, with backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Not in CISA KEV (catalog 2026.11.10, 1,779 entries, checked 10 Nov 2026). FIRST EPSS had no row (total 0). CVE.org id state RESERVED; NVD API returned zero records. Badge: No known ITW. No public PoC indexed.","isExample":false,"draft":false,"family":"git-recursive-clone-rce-cve-2026-111760","kind":"shared-component","aliases":["CVE-2026-111760","GHSA-vp2w-7xxj-jvxr","Git recursive clone RCE","Git submodule clone code execution"],"publishedAt":"2026-11-10","updatedAt":"2026-11-11","patchStatus":"patched","exploited":false,"scores":{"cve":"CVE-2026-111760","cvss":{"cve":"CVE-2026-111760","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","sourceDate":"2026-11-10","checkedDate":"2026-11-10","dateLabel":"GHSA published","sourceLabel":"git/git GHSA-vp2w-7xxj-jvxr (CVSS 3.1 8.0, published 2026-11-10). This is the Git project GitHub Security Advisory, not a CVE.org or NVD Primary metric. CVE.org id API state RESERVED. NVD CVE 2.0 API returned totalResults 0 on 10 Nov 2026. GitHub blog, The Hacker News, and RelNotes publish no CVSS."},"epss":{"cve":"CVE-2026-111760","score":null,"percentile":null,"date":null,"sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-111760","checkedDate":"2026-11-10"},"kev":{"cve":"CVE-2026-111760","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-10"},"addedDate":"2026-11-10"},"priority":{"label":"watch"},"managementSummary":{"what":"Integer truncation in Git index path handling can let a malicious repository load attacker-controlled hooks during a recursive clone (CVE-2026-111760, git/git GHSA CVSS 3.1 8.0). The victim must recursively clone an attacker-controlled repo. GitHub currently believes this needs --recurse-submodules. No known in-the-wild use as of 10 Nov 2026. Not in CISA KEV (catalog 2026.11.10). No public PoC indexed.","action":"Upgrade Git to 2.56.1 or the matching backport (2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2), and update applications that bundle Git. GHES administrators should install 3.19.15, 3.20.11, 3.21.9, or 3.22.4. Until then, clone only from trusted servers and avoid recursive clones of untrusted repositories. GitHub: those precautions do not replace installing the fixes."},"whatChanged":{"date":"2026-11-11","items":[{"text":"Git for Windows 2.56.1.windows.1 (published 2026-11-10T22:13:20Z) addresses CVE-2026-111760. Release notes link that CVE to GHSA-vp2w-7xxj-jvxr. Accessed 11 Nov 2026.","headline":"Git for Windows 2.56.1.windows.1 fixes CVE-2026-111760","section":"fixed-versions","date":"2026-11-11","sourceUrl":"https://github.com/git-for-windows/git/releases/tag/v2.56.1.windows.1","alsoSourceUrl":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","addedDate":"2026-11-11"},{"text":"New catalog page for Git recursive clone code execution CVE-2026-111760 / GHSA-vp2w-7xxj-jvxr.","headline":"New catalog page for Git recursive clone CVE-2026-111760","section":"overview","date":"2026-11-10","kind":"page"},{"text":"Git 2.56.1 fixes CVE-2026-111760. RelNotes 2.56.1 merge up the same six-CVE fix from 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, and 2.55.1. GitHub's 10 Nov 2026 blog lists the same versions. Freenode's claim of fixes back to 2.43 is not in those RelNotes and is not used here.","headline":"Git 2.56.1 and backports 2.50.2 through 2.55.1 fix CVE-2026-111760","section":"fixed-versions","date":"2026-11-10","sourceUrl":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","alsoSourceUrl":"https://raw.githubusercontent.com/git/git/v2.56.1/Documentation/RelNotes/2.56.1.adoc"},{"text":"GitHub deployed fixes on github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency. GHES fixes are in 3.19.15, 3.20.11, 3.21.9, and 3.22.4 (admin release notes, Release date 2026-11-10). GitHub Desktop and the GitHub Copilot app are coordinating patched Git releases. Codespaces and Actions will receive patched Git. Git for Windows latest public tag remains v2.56.0.windows.4 (26 Oct 2026); The Hacker News recorded no 2.56.1-based Git for Windows release as of 10 Nov 2026 19:09 UTC, and a live recheck of the releases page on 10 Nov 2026 still showed that tag.","headline":"GitHub deployed hosted fixes; GHES patched; Desktop and Copilot still in prep","section":"fixed-versions","date":"2026-11-10","sourceUrl":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","alsoSourceUrl":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes"},{"text":"No known in-the-wild use as of 10 Nov 2026. Not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries). GitHub blog, GHSA-vp2w-7xxj-jvxr, RelNotes, and The Hacker News do not report attacks. No public PoC indexed. git/git GHSA scores CVSS 3.1 8.0. FIRST EPSS returned total 0. CVE.org id API state RESERVED. NVD CVE 2.0 API returned totalResults 0.","headline":"No known ITW; not in KEV catalog 2026.11.10; GHSA CVSS 8.0","section":"exploitation","date":"2026-11-10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr"}]},"whatTheBugIs":"CVE-2026-111760 is code execution during a recursive Git clone. GitHub (Elijah Newren, 10 Nov 2026): Git checks paths before writing files into a working tree, including rejecting paths that would overwrite its own repository metadata. An integer truncation in Git's index handling can cause an extremely long path to pass validation under one name and then be written using a shorter name. An attacker can use that discrepancy to replace a submodule's .git file with a symbolic link pointing to a directory containing malicious configuration or hooks. When Git subsequently uses that directory, it can execute attacker-controlled code during a recursive clone. The fix rejects extremely long index entry paths before their lengths can be truncated.\n\nRelNotes 2.50.2: an attacker-controlled repository can be crafted so Git overwrites a gitfile (used for submodules) with a symbolic link that then points to a directory with malicious config or hooks. The config or hooks may have attacker-specified code.\n\nGHSA-vp2w-7xxj-jvxr (published 10 Nov 2026, High, CVSS 3.1 8.0, vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, no CWE listed): currently believed only with --recurse-submodules. The attacker-controlled repository is hosted by the attacker rather than on a normal forge site. Workaround text: as always, it is best to avoid cloning repositories from untrusted sources.\n\nThe Hacker News (Swati Khandelwal, 10 Nov 2026): Git refuses to replace a .git folder with a symbolic link, but in a freshly cloned submodule .git is a file. Hooks are programs Git runs at set points, so once Git uses that folder, the attacker's code can run. This page stays high level. It does not describe payloads, staging details, or reproduction steps.\n\nFixed versions. GitHub blog and RelNotes 2.56.1: Git 2.56.1, with backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. RelNotes 2.56.1 says that release merges up the fix that appears in those six maintenance versions to address CVE-2026-111760 and five same-release CVEs that do not have a shell path on this page.\n\nSame-release CVEs without a shell path (GitHub blog and RelNotes 2.50.2, 10 Nov 2026; one line, not aliases): CVE-2026-113408 path traversal through a server's advertised HEAD; CVE-2026-114467 stack corruption when stripping more than two GPG signatures; CVE-2026-114469 out-of-bounds read applying binary patches; CVE-2026-105437 heap corruption during large merges (The Hacker News: GitLab assigned this CVE; workaround for that sibling only is conflict-marker-size=7 in each repository's info/attributes, or turn off merge checks for untrusted repos); CVE-2026-114466 filesystem access through fast-import rewrite-submodules-from/to and export-pack-edges. Those five are not this recursive-clone hook path.\n\nExploitation. No known in-the-wild use as of 10 Nov 2026. Badge: No known ITW. GitHub, GHSA, RelNotes, The Hacker News, and freenode do not report attacks. Not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries). FIRST EPSS total 0. CVE.org id API state RESERVED. NVD CVE 2.0 API totalResults 0. No public PoC indexed.\n\nCredit. GHSA-vp2w-7xxj-jvxr credits newren (remediation developer) and peff and dscho (remediation reviewers). The GitHub blog is by Elijah Newren. freenode (10 Nov 2026) names Luke Martin and pwn2addr as finders; that finder credit is not on the GitHub blog, RelNotes, or GHSA, so this page does not treat it as confirmed Git-project finder credit.","attackPath":{"caption":"High-level only. Not a reproduction guide. No payloads, clone flags beyond the sourced --recurse-submodules precondition, or usage steps. GHSA currently believes this needs a recursive clone of an attacker-hosted repository.","steps":[{"id":"reach","label":"Untrusted recursive clone","detail":"A developer, CI job, or server automation recursively clones a repository the attacker controls."},{"id":"unsafe","label":"Index path truncation","detail":"An extremely long index path can pass validation under one name and then be written under a shorter name."},{"id":"exec","label":"Submodule .git becomes a symlink","detail":"The submodule gitfile can be replaced with a symbolic link to a directory of attacker-controlled config or hooks."},{"id":"shell","label":"Hooks run during the clone","detail":"When Git uses that directory, attacker-controlled hooks can run as the cloning user."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 10 Nov 2026) against catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries). CVE-2026-111760 has no catalog row."},"firstSeen":{"date":null,"source":"GitHub blog (Elijah Newren, 10 Nov 2026). GHSA-vp2w-7xxj-jvxr. RelNotes 2.56.1 / 2.50.2. The Hacker News (Swati Khandelwal, 10 Nov 2026). CISA KEV catalog 2026.11.10.","note":"No known in-the-wild use as of 10 Nov 2026. GitHub, GHSA, RelNotes, and The Hacker News do not report attacks. Badge: No known ITW."},"vendorStatements":[{"vendor":"Git project / GitHub","date":"2026-11-10","statement":"Today, the Git project is releasing new versions to address six security vulnerabilities. These include arbitrary code execution when recursively cloning a malicious repository. The fixes are included in Git 2.56.1, with backports to Git 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2.","url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","retracted":false},{"vendor":"git/git GHSA","date":"2026-11-10","statement":"As always, it is best to avoid cloning repositories from untrusted sources. We currently believe this can only be triggered when the `--recurse-submodules` option is used.","url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","retracted":false},{"vendor":"GitHub","date":"2026-11-10","statement":"If you cannot update immediately, clone only from trusted servers and avoid recursive clones of untrusted repositories. These precautions do not replace installing the fixes.","url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","retracted":false}]},"timeline":[{"date":"2026-11-10","event":"Elijah Newren published Git security vulnerabilities announced on the GitHub blog. Six CVEs. CVE-2026-111760 is code execution during recursive clones. Fixes in Git 2.56.1 and backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2.","source":{"title":"Git security vulnerabilities announced","url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","publisher":"GitHub Blog"},"kind":"advisory","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10T19:09:09Z","event":"newren published GHSA-vp2w-7xxj-jvxr (Recursive clones are susceptible to Remote Code Execution). High. CVSS 3.1 8.0. No CWE listed. Credits: newren remediation developer; peff and dscho remediation reviewers.","source":{"title":"GHSA-vp2w-7xxj-jvxr","url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","publisher":"git/git"},"kind":"advisory","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"Git v2.56.1 RelNotes: this release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1, v2.54.1 and v2.55.1 to address CVE-2026-111760 and five sibling CVEs. Tag v2.56.1 exists; GitHub Releases page for that tag returned 404.","source":{"title":"Git v2.56.1 Release Notes","url":"https://raw.githubusercontent.com/git/git/v2.56.1/Documentation/RelNotes/2.56.1.adoc","publisher":"Git project"},"kind":"patch","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"Git v2.50.2 RelNotes describe CVE-2026-111760 as recursive-clone RCE via overwriting a submodule gitfile with a symbolic link to malicious config or hooks, plus the five sibling CVEs.","source":{"title":"Git v2.50.2 Release Notes","url":"https://raw.githubusercontent.com/git/git/v2.50.2/Documentation/RelNotes/2.50.2.adoc","publisher":"Git project"},"kind":"patch","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"GitHub Enterprise Server admin release notes for 3.19.15, 3.20.11, 3.21.9, and 3.22.4 (Release date 2026-11-10): HIGH: Updated Git to include fixes that address CVE-2026-105437, CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, and CVE-2026-114469.","source":{"title":"GitHub Enterprise Server 3.22 release notes","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes","publisher":"GitHub"},"kind":"vendor","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"The Hacker News (Swati Khandelwal) covers CVE-2026-111760, the GitHub downstream matrix, Git for Windows with no 2.56.1-based release as of Tuesday 19:09 UTC, and GitLab's sibling CVE-2026-105437 workaround.","source":{"title":"Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones","url":"https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"freenode reports Git 2.56.1 and matching maintenance updates, names Luke Martin and pwn2addr as finders, and claims fixes back to the 2.43 series. Finder credit and the 2.43 claim are not in RelNotes or GHSA.","source":{"title":"Git ships security fixes, including a recursive-clone code execution bug","url":"https://freenode.net/article/git-ships-security-fixes-including-a-recursive-clone-code-execution-bug","publisher":"freenode"},"kind":"other","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"Not in CISA KEV. Catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries. CVE-2026-111760 has no catalog row.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"CVE.org id API for CVE-2026-111760 returns state RESERVED. The CVE record API returns CVE_RECORD_DNE. NVD CVE 2.0 API returns totalResults 0.","source":{"title":"CVE-2026-111760 (CVE.org id API)","url":"https://cveawg.mitre.org/api/cve-id/CVE-2026-111760","publisher":"CVE.org"},"kind":"advisory","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"Git for Windows releases page still lists v2.56.0.windows.4 (26 Oct 2026, CVE-2026-111497 brotli) as the latest tag. No 2.56.1-based Git for Windows release on that page.","source":{"title":"Git for Windows releases","url":"https://github.com/git-for-windows/git/releases","publisher":"Git for Windows"},"kind":"other","addedDate":"2026-11-10"},{"date":"2026-11-10T22:13:20Z","event":"Git for Windows v2.56.1.windows.1 published. Release notes address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469, and CVE-2026-105437, and link CVE-2026-111760 to GHSA-vp2w-7xxj-jvxr.","source":{"title":"Git for Windows 2.56.1","url":"https://github.com/git-for-windows/git/releases/tag/v2.56.1.windows.1","publisher":"Git for Windows"},"kind":"patch","key":true,"addedDate":"2026-11-11"}],"openNotes":[{"title":"Freenode 2.43 claim is not in RelNotes","detail":"freenode (10 Nov 2026) says security updates cover older maintenance lines back to the 2.43 series. GitHub's blog and RelNotes 2.56.1 / 2.50.2 list 2.50.2 through 2.56.1 only. This page does not add 2.43.","sources":[{"url":"https://freenode.net/article/git-ships-security-fixes-including-a-recursive-clone-code-execution-bug","date":"2026-11-10","publisher":"freenode"},{"url":"https://raw.githubusercontent.com/git/git/v2.56.1/Documentation/RelNotes/2.56.1.adoc","date":"2026-11-10","publisher":"Git project"}]},{"title":"Finder credit on freenode is not on GHSA or RelNotes","detail":"freenode names Luke Martin and pwn2addr as finders and says Johannes Schindelin organized the updates. GHSA-vp2w-7xxj-jvxr credits newren, peff, and dscho for remediation only. RelNotes 2.50.2 / 2.56.1 do not name finders. This page does not treat the freenode finder names as confirmed Git-project credit.","sources":[{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"},{"url":"https://freenode.net/article/git-ships-security-fixes-including-a-recursive-clone-code-execution-bug","date":"2026-11-10","publisher":"freenode"}]},{"title":"GHSA still says patches are being discussed","detail":"GHSA-vp2w-7xxj-jvxr lists affected versions all and shows no patched versions, with Patches are being discussed on the git-security mailing list. RelNotes and the GitHub blog already ship 2.56.1 and the listed backports. This page uses RelNotes / the blog for the fix list and keeps the GHSA wording as an open note.","sources":[{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"},{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"}]},{"title":"CVE.org RESERVED; no NVD record; no GitHub Release object","detail":"CVE.org id API state RESERVED; record API CVE_RECORD_DNE. NVD CVE 2.0 API totalResults 0 on 10 Nov 2026. https://github.com/git/git/releases/tag/v2.56.1 returned 404; tag v2.56.1 and raw RelNotes exist. git-scm.com RelNotes HTML and kernel.org /pub RelNotes paths 404'd; git.kernel.org plain RelNotes for v2.56.1 returned 200.","sources":[{"url":"https://cveawg.mitre.org/api/cve-id/CVE-2026-111760","date":"2026-11-10","publisher":"CVE.org"},{"url":"https://raw.githubusercontent.com/git/git/v2.56.1/Documentation/RelNotes/2.56.1.adoc","date":"2026-11-10","publisher":"Git project"}]},{"title":"Same-release CVEs are not this shell path","detail":"CVE-2026-113408, CVE-2026-114467, CVE-2026-114469, CVE-2026-105437, and CVE-2026-114466 shipped in the same Git releases. They are not aliases on this page. The conflict-marker-size=7 workaround is sourced only for sibling CVE-2026-105437 (The Hacker News quoting GitLab), not for CVE-2026-111760.","sources":[{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"},{"url":"https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html","date":"2026-11-10","publisher":"The Hacker News"}]}],"defenderActions":[{"title":"Upgrade Git to 2.56.1 or the matching backport","detail":"GitHub: install a patched version from your operating system or Git distributor. Fixed: 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2.","priority":"now","links":[{"label":"GitHub blog announcement","href":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/"},{"label":"Git 2.56.1 RelNotes","href":"https://raw.githubusercontent.com/git/git/v2.56.1/Documentation/RelNotes/2.56.1.adoc"}]},{"title":"Update applications that bundle Git","detail":"GitHub: update applications that include their own copy of Git, and Git installations used by automation and services that process repositories on behalf of users. GHES: 3.19.15, 3.20.11, 3.21.9, 3.22.4. Desktop and Copilot app releases were still being coordinated on 10 Nov 2026.","priority":"now","links":[{"label":"GitHub blog: protecting GitHub users","href":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/"},{"label":"GHES 3.22 release notes","href":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes"}]},{"title":"Until patched, do not recursively clone untrusted repos","detail":"GitHub: clone only from trusted servers and avoid recursive clones of untrusted repositories. Those precautions do not replace installing the fixes. Do not use a crafted clone as a test.","priority":"now","links":[{"label":"GitHub blog: Update Git","href":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/"}]}],"detection":[{"title":"git spawning shells or unexpected binaries during a recursive clone","detail":"Hunt EDR process telemetry for git spawning a shell or an unexpected binary while a recursive clone is running. A hit is a behavioural lead, not proof of CVE-2026-111760, and not a signature or IOC. No vendor IOCs were published.","logSource":"EDR process telemetry (git parent, child process, command line)","kind":"generic","group":"edr","url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","dateKind":"checked","described":true},{"title":".git symlinks inside submodule working trees","detail":"Hunt filesystem or EDR file events for a .git symbolic link inside a submodule working tree. GHSA and RelNotes describe replacing a submodule gitfile with a symlink to a directory of config or hooks. A hit is a behavioural lead, not proof of this CVE, and not a signature or IOC. No vendor IOCs were published.","logSource":"Filesystem or EDR file events on submodule working trees","kind":"generic","group":"edr","url":"https://raw.githubusercontent.com/git/git/v2.50.2/Documentation/RelNotes/2.50.2.adoc","date":"2026-11-10","dateKind":"checked","described":true}],"detectionRules":[],"detectionLinks":[],"amIAffected":{"summary":"Any Git before 2.56.1 (or the matching backport) that recursively clones untrusted repositories is in scope. Inventory git --version, apps that bundle Git, and whether CI or automation uses --recurse-submodules. Do not clone a crafted repository as a test.","checks":[{"id":"v2s-aia-git-recursive-clone-rce-cve-2026-111760-version-1","kind":"version","title":"Record the installed Git version","detail":"GitHub: fixed in 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Record git --version. This is inventory only. Do not clone a test repository.","command":"Record git --version on developer workstations, CI images, and servers that clone repositories, then compare it to 2.56.1 or the matching backport for that series.","affectedMeans":"Git is older than 2.56.1 and is not one of 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, or 2.50.2.","fixedMeans":"Git is 2.56.1 or a listed backport, or Git is not installed.","notes":"Apps that bundle their own Git need a separate inventory. Git for Windows is fixed in 2.56.1.windows.1 (released 10 Nov 2026, accessed 11 Nov 2026).","sources":[{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"}]},{"id":"v2s-aia-git-recursive-clone-rce-cve-2026-111760-config-1","kind":"config","title":"Record whether recursive clones of untrusted repos happen","detail":"GHSA currently believes the bug needs --recurse-submodules. Record CI jobs, developer clone habits, and server automation that recursively clone repositories you do not control. Do not run a crafted recursive clone as a test.","command":"Record CI and automation clone commands (including --recurse-submodules or submodule update --init --recursive) and whether any job clones repositories outside your org.","affectedMeans":"Unpatched Git recursively clones repositories that are not from a trusted server.","fixedMeans":"Jobs only clone from trusted servers without recurse-submodules, or Git is patched.","notes":"GitHub: clone only from trusted servers and avoid recursive clones of untrusted repositories until patched. Those precautions do not replace installing the fixes.","sources":[{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"},{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"}]},{"id":"v2s-aia-git-recursive-clone-rce-cve-2026-111760-package-1","kind":"package","title":"Record apps and hosts that bundle Git","detail":"GitHub: update applications that include their own copy of Git. Inventory GitHub Desktop, the GitHub Copilot app, GHES, Codespaces-equivalent self-hosted runners, and other bundled Git. Do not treat github.com as a customer patch step.","command":"Record GitHub Desktop, Copilot app, GHES, self-hosted Actions runner, and other bundled-Git versions in the estate.","affectedMeans":"A bundled Git is below 2.56.1 / the matching backport, or GHES is below 3.19.15 / 3.20.11 / 3.21.9 / 3.22.4 on that series.","fixedMeans":"Bundled Git is patched, GHES is on a listed version, or the estate only uses GitHub-hosted github.com / GHEC (vendor-managed).","notes":"GitHub Desktop and Copilot app fixes were still being coordinated on 10 Nov 2026. Codespaces and Actions were still waiting on patched Git.","sources":[{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"},{"url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes","date":"2026-11-10","publisher":"GitHub"}]}],"limits":["Do not clone a crafted repository as a test.","GitLab, distros, Xcode Command Line Tools, and Bitbucket had no product statement on CVE-2026-111760 as of 10 Nov 2026. Git for Windows is fixed in 2.56.1.windows.1 (released 10 Nov 2026, accessed 11 Nov 2026).","github.com / GHEC customers have no patch step; GHES administrators still need to upgrade."],"sources":[{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"},{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"}],"updatedAt":"2026-11-11","addedDate":"2026-11-10"},"mitigations":{"summary":"GitHub published operational precautions until a patched Git is installed: clone only from trusted servers and avoid recursive clones of untrusted repositories. GitHub says those precautions do not replace installing the fixes. The conflict-marker-size=7 attribute is sourced only for sibling CVE-2026-105437, not for this CVE.","items":[{"title":"Clone only from trusted servers","detail":"GitHub: if you cannot update immediately, clone only from trusted servers.","limits":"GitHub: these precautions do not replace installing the fixes. They do not cover apps that still bundle unpatched Git.","verify":"Record clone remotes used by developers, CI, and automation, and confirm they are servers you trust. This is policy, not a software fix.","source":{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"}},{"title":"Avoid recursive clones of untrusted repositories","detail":"GitHub: avoid recursive clones of untrusted repositories. GHSA currently believes CVE-2026-111760 needs --recurse-submodules.","limits":"GitHub: these precautions do not replace installing the fixes. Skipping recurse-submodules is not a substitute for 2.56.1 or the matching backport.","verify":"Record whether CI and developer clone commands use --recurse-submodules or submodule update --init --recursive against remotes you do not control.","source":{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"}}],"updatedAt":"2026-11-10","addedDate":"2026-11-10"},"response":{"summary":"If unpatched Git recursively cloned untrusted repositories, treat that host as exposed. Upgrade Git, review EDR process telemetry for git spawning unexpected children during recursive clones, and review filesystem events for .git symlinks in submodule working trees. No vendor IOCs were published. This is not a claim of in-the-wild use.","containment":[{"title":"Upgrade Git and bundled copies","detail":"Install Git 2.56.1 or the matching backport. Update apps that bundle Git. GHES administrators should install 3.19.15, 3.20.11, 3.21.9, or 3.22.4.","sources":[{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"}]},{"title":"Stop recursive clones of untrusted remotes until patched","detail":"GitHub: clone only from trusted servers and avoid recursive clones of untrusted repositories. Those precautions do not replace installing the fixes.","sources":[{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"}]},{"title":"Review process and file telemetry from recursive clones","detail":"Hunt git spawning shells or unexpected binaries during recursive clones, and .git symlinks inside submodule working trees. A hit is a lead, not proof.","sources":[{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"}]}],"rotate":[{"item":"Credentials and secrets readable by the account that ran git clone","reason":"If hooks ran, they ran as the cloning user, including CI service accounts. Rotate secrets that account could read. Generic IR; GitHub did not publish a credential list.","generic":true,"sources":[{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"}]}],"evidence":[{"title":"Installed Git version from before the upgrade","detail":"Keep git --version, package, or bundled-Git output so you can show whether the install was below 2.56.1 / the matching backport.","sources":[{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"}]},{"title":"Clone command lines and remotes","detail":"Keep CI logs showing --recurse-submodules or equivalent against remotes you did not control.","sources":[{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"}]},{"title":"EDR process and file telemetry around recursive clones","detail":"Keep git parent/child process trees and .git symlink file events from submodule working trees. No sourced persistence path was published.","generic":true,"sources":[{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"}]}],"limits":["No vendor IOCs were published.","No known in-the-wild use as of 10 Nov 2026.","A git child process or a .git symlink is a lead, not proof of this CVE."],"sources":[{"url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","publisher":"GitHub Blog"},{"url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","publisher":"git/git"}],"updatedAt":"2026-11-10","addedDate":"2026-11-10"},"bulletins":[],"coverage":[{"title":"Git security vulnerabilities announced","publisher":"GitHub Blog / Elijah Newren","url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","date":"2026-11-10","type":"vendor","addedDate":"2026-11-10"},{"title":"Git for Windows 2.56.1 (v2.56.1.windows.1)","publisher":"Git for Windows","url":"https://github.com/git-for-windows/git/releases/tag/v2.56.1.windows.1","date":"2026-11-10","type":"vendor","addedDate":"2026-11-11"},{"title":"GHSA-vp2w-7xxj-jvxr","publisher":"git/git","url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","date":"2026-11-10","type":"vendor","addedDate":"2026-11-10"},{"title":"Git v2.56.1 Release Notes","publisher":"Git project","url":"https://raw.githubusercontent.com/git/git/v2.56.1/Documentation/RelNotes/2.56.1.adoc","date":"2026-11-10","type":"vendor","addedDate":"2026-11-10"},{"title":"Git v2.50.2 Release Notes","publisher":"Git project","url":"https://raw.githubusercontent.com/git/git/v2.50.2/Documentation/RelNotes/2.50.2.adoc","date":"2026-11-10","type":"vendor","addedDate":"2026-11-10"},{"title":"GitHub Enterprise Server 3.22.4 release notes","publisher":"GitHub","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes","date":"2026-11-10","type":"vendor","addedDate":"2026-11-10"},{"title":"GitHub Enterprise Server 3.19.15 release notes","publisher":"GitHub","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes","date":"2026-11-10","type":"vendor","addedDate":"2026-11-10"},{"title":"Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html","date":"2026-11-10","type":"news","addedDate":"2026-11-10"},{"title":"Git ships security fixes, including a recursive-clone code execution bug","publisher":"freenode","url":"https://freenode.net/article/git-ships-security-fixes-including-a-recursive-clone-code-execution-bug","date":"2026-11-10","type":"news","addedDate":"2026-11-10"},{"title":"CISA KEV catalog JSON (CVE-2026-111760 not listed; catalog 2026.11.10, 1,779 entries)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-10","type":"government","addedDate":"2026-11-10"},{"title":"CVE-2026-111760 id API (state RESERVED)","publisher":"CVE.org","url":"https://cveawg.mitre.org/api/cve-id/CVE-2026-111760","date":"2026-11-10","type":"government","addedDate":"2026-11-10"}],"posts":[],"research":[{"title":"GHSA-vp2w-7xxj-jvxr","url":"https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr","authors":"newren (remediation developer); peff and dscho (remediation reviewers)","date":"2026-11-10"}],"impact":{"kind":"shared-component","component":"Git recursive clone","matrixNote":"Git is a shared component. Hosted GitHub services were patched by GitHub. Git for Windows is fixed in 2.56.1.windows.1 (released 10 Nov 2026). Desktop, Copilot, Codespaces, and Actions still had pending Git updates on 10 Nov 2026. Distros, GitLab, Bitbucket, and Xcode Command Line Tools had no product statement on CVE-2026-111760 yet. Never read silence as safe.","downstream":[{"product":"Git","vendor":"Git project","type":"cms-app","notes":"RelNotes 2.56.1 merge up the same six-CVE fix from those maintenance versions. GHSA still shows affected versions all and no patched versions.","status":"affected","versions":"fixed in 2.56.1; backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2","vendorStatement":{"date":"10 Nov 2026","url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","quote":"The fixes are included in Git 2.56.1, with backports to Git 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2."},"addedDate":"2026-11-10"},{"product":"github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency","vendor":"GitHub","type":"cloud-container-hosting","status":"vendor-managed-no-action","versions":"fixes deployed","vendorStatement":{"date":"10 Nov 2026","url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","quote":"We have deployed fixes for these vulnerabilities across github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency."},"addedDate":"2026-11-10"},{"product":"GitHub Enterprise Server","vendor":"GitHub","type":"cloud-container-hosting","notes":"GitHub blog lists the same GHES versions and asks administrators to upgrade as soon as possible. 3.19.15 and 3.22.4 admin notes both show Release date 2026-11-10 and the same HIGH Git line.","status":"affected","versions":"fixed in 3.19.15, 3.20.11, 3.21.9, 3.22.4","vendorStatement":{"date":"10 Nov 2026","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes","quote":"HIGH: Updated Git to include fixes that address CVE-2026-105437, CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, and CVE-2026-114469."},"addedDate":"2026-11-10"},{"product":"GitHub Desktop and GitHub Copilot app","vendor":"GitHub","type":"cms-app","notes":"The Hacker News: fixed versions of GitHub Desktop and the GitHub Copilot app are being prepared.","status":"affected","versions":"patched Git releases being coordinated; no ETA published","vendorStatement":{"date":"10 Nov 2026","url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","quote":"We are coordinating releases of GitHub Desktop and the GitHub Copilot app that include patched versions of Git."},"addedDate":"2026-11-10"},{"product":"GitHub Codespaces and GitHub Actions","vendor":"GitHub","type":"cloud-container-hosting","status":"affected","versions":"will receive patched Git; no ETA published","vendorStatement":{"date":"10 Nov 2026","url":"https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/","quote":"GitHub Codespaces and GitHub Actions will also receive patched versions of Git."},"addedDate":"2026-11-10"},{"product":"Git for Windows","vendor":"Git for Windows","type":"cms-app","notes":"Published 2026-11-10T22:13:20Z. Release notes link CVE-2026-111760 to git/git GHSA-vp2w-7xxj-jvxr. Accessed 11 Nov 2026.","status":"affected","versions":"fixed in 2.56.1.windows.1 (released 10 Nov 2026)","vendorStatement":{"date":"11 Nov 2026","url":"https://github.com/git-for-windows/git/releases/tag/v2.56.1.windows.1","quote":"This addresses the security issues CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437."},"addedDate":"2026-11-10"},{"product":"GitLab CE / EE","vendor":"GitLab","type":"cloud-container-hosting","notes":"No GitLab product statement on CVE-2026-111760 found on 10 Nov 2026. The Hacker News reports GitLab assigned sibling CVE-2026-105437 (heap corruption on large merges) and a conflict-marker-size=7 workaround for that sibling only. That is not a CVE-2026-111760 verdict.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://docs.gitlab.com/releases/"},"addedDate":"2026-11-10"},{"product":"Ubuntu git package","vendor":"Canonical","type":"linux-distro","notes":"Ubuntu CVE page returned 404 on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://ubuntu.com/security/CVE-2026-111760"},"addedDate":"2026-11-10"},{"product":"Debian git package","vendor":"Debian","type":"linux-distro","notes":"Debian security tracker returned 404 on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://security-tracker.debian.org/tracker/CVE-2026-111760"},"addedDate":"2026-11-10"},{"product":"Red Hat Enterprise Linux git package","vendor":"Red Hat","type":"linux-distro","notes":"Red Hat CVE page returned 404 on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://access.redhat.com/security/cve/CVE-2026-111760"},"addedDate":"2026-11-10"},{"product":"Fedora git package","vendor":"Fedora","type":"linux-distro","notes":"Bugzilla URL returned a generic page, not a CVE-2026-111760 advisory, on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-111760"},"addedDate":"2026-11-10"},{"product":"SUSE git package","vendor":"SUSE","type":"linux-distro","notes":"SUSE CVE page returned 404 on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://www.suse.com/security/cve/CVE-2026-111760.html"},"addedDate":"2026-11-10"},{"product":"Alpine Linux git package","vendor":"Alpine Linux","type":"linux-distro","notes":"Alpine vuln page returned 404 on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"addedDate":"2026-11-10"},{"product":"Arch Linux git package","vendor":"Arch Linux","type":"linux-distro","notes":"Arch Linux CVE page returned 404 on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://security.archlinux.org/CVE-2026-111760"},"addedDate":"2026-11-10"},{"product":"Apple Xcode Command Line Tools","vendor":"Apple","type":"cms-app","notes":"Apple security updates index had no Git or CVE-2026-111760 row on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://support.apple.com/en-us/100100"},"addedDate":"2026-11-10"},{"product":"Bitbucket Cloud / Data Center","vendor":"Atlassian","type":"cloud-container-hosting","notes":"Atlassian November 2026 advisories list Confluence Data Center CVE-2026-90436. No Bitbucket or CVE-2026-111760 advisory on that page on 10 Nov 2026.","status":"no-statement-yet","vendorStatement":{"date":"Checked 10 Nov 2026","url":"https://www.atlassian.com/trust/security/advisories"},"addedDate":"2026-11-10"}]},"pocs":[],"pocEmptyState":"No public PoC indexed as of 10 Nov 2026. GitHub, GHSA-vp2w-7xxj-jvxr, RelNotes, and The Hacker News do not publish a PoC. This site does not copy exploit code.","_feed":{"page":"https://vuln2shell.com/vulns/git-recursive-clone-rce-cve-2026-111760","json":"https://vuln2shell.com/vulns/git-recursive-clone-rce-cve-2026-111760.json","iocsCsv":"https://vuln2shell.com/vulns/git-recursive-clone-rce-cve-2026-111760/iocs.csv","stix":"https://vuln2shell.com/vulns/git-recursive-clone-rce-cve-2026-111760/stix.json","badges":{"patch":"Patched","itw":"No known ITW","poc":"No public PoC indexed"}}}