A vulnerability in Git allows for code execution when cloning from a malicious Git repository.

Corrective releases for the distributed version control system Git 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2 have been published, addressing 6 vulnerabilities. The most dangerous vulnerability (CVE-2026-111760) allows code execution when using the 'git clone' command in '--recurse-submodules' mode with repositories controlled by the attacker.

The issue is caused by the length of the name entry in the index being calculated using a 32-bit integer type. When passing a very long name like '.git/….', an integer overflow occurs, allowing the attacker to compute a length equal to 4 bytes. As a result, actual data is used in the value check, while the truncated version '.git' is used during the operation, enabling the attacker to replace the '.git' file in the submodule with a symbolic link pointing to a directory containing settings and hooks.

Other vulnerabilities:

• CVE-2026-113408 — directory traversal through passing a symbolic link with the value 'refs/heads/../../..../TARGET' as the HEAD branch when cloning an empty repository using Git v2. A subsequent execution of 'git commit' will create a TARGET file in the root of the repository, which can be exploited to overwrite files in the repository and facilitate code execution.
• CVE-2026-114467 — stack overflow when deleting GPG signatures, which could potentially lead to arbitrary code execution. The issue arises because the remove_signature() function stores signature positions in a fixed array that is designed to accommodate a maximum of two signatures. When a tag with three or more signatures is passed, the data is stored outside the array.
• CVE-2026-114469 — when checking constraints on the size of binary patches, data prior to unpacking compressed data was considered, which led to reading content from outside the buffer boundaries.
• CVE-2026-105437 — memory corruption during large merge operations due to the accumulation of the result size in an int field. In GitLab configuration, the vulnerability can be exploited for code execution (the issue is blocked in GitLab 19.5.4).
• CVE-2026-114466 — arbitrary file overwrite in the filesystem through the 'git fast-import' command due to incomplete remediation of vulnerability CVE-2019-1348.

Source: opennet.ru