Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A vulnerability in Git allows a malicious repository to execute code on a computer during a recursive clone, including submodules. The issue has been fixed in Git version 2.56.1, as well as in updated versions for the 2.50 through 2.55 series. The flaw is related to an integer truncation in Git's index handling. It has been assigned a CVE identifier, CVE-2026-111760. The fixes were released this week, addressing the potential security risk.