{"id":184239,"date":"2026-11-12T11:41:56","date_gmt":"2026-11-12T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-git-dopuskayushhaya-vypolnenie-koda-pri-klonirovanii-iz-vredonosnogo-git-repozitoriya"},"modified":"2026-11-12T11:42:03","modified_gmt":"2026-11-12T09:42:03","slug":"git-vulnerability-allows-code-execution-when-cloning-a-malicious-git-repository","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/git-vulnerability-allows-code-execution-when-cloning-a-malicious-git-repository","title":{"rendered":"A vulnerability in Git allows for code execution when cloning from a malicious Git repository.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases of the distributed version control system Git 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2 have been published, addressing 6 vulnerabilities. The most critical vulnerability (CVE-2026-111760) allows for code execution when using the 'git clone' command in '--recurse-submodules' mode with repositories controlled by the attacker.<\/p>\n
The issue is caused by the fact that the length of the index entry name is calculated using a 32-bit integer type. When passing a very long name such as '.git\/...', an integer overflow occurs, and the attacker can obtain a computed length equal to 4 bytes. As a result, the actual data is used during the value check, while a truncated version of '.git' is used during the operation, allowing the attacker to replace the '.git' file in the submodule with a symbolic link pointing to a directory with configurations and hooks.<\/p>\n
Other vulnerabilities:<\/p>\n
\n
CVE-2026-113408 \u2014 directory traversal via passing a symbolic link with the value 'refs\/heads\/..\/..\/..\/TARGET' as the branch HEAD when cloning an empty repository using Git v2 protocol. Upon subsequent execution of 'git commit', a TARGET file will be created in the root of the repository, which can be used to overwrite files in the repository and initiate code execution.\n
CVE-2026-114467 \u2014 stack overflow when removing GPG signatures, which may potentially lead to arbitrary code execution. The issue arises because the remove_signature() function stores signature positions in a fixed array designed for a maximum of two signatures. When passing a tag with three or more signatures, data is saved outside the array.\n
CVE-2026-114469 \u2014 while checking limits on the size of binary patches, data prior to unpacking compressed data was taken into account, leading to reading content from outside the buffer boundaries.\n
CVE-2026-105437 \u2014 memory corruption during large merge operations due to the result size accumulation in an int type field. In the GitLab configuration, this vulnerability can be exploited for code execution (this issue is blocked in GitLab 19.5.4).\n
CVE-2026-114466 \u2014 arbitrary file overwrite in the filesystem through the 'git fast-import' command due to incomplete mitigation of the CVE-2019-1348 vulnerability.\n<\/ul>\n