{"id":184239,"date":"2026-11-12T11:41:56","date_gmt":"2026-11-12T09:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-git-dopuskayushhaya-vypolnenie-koda-pri-klonirovanii-iz-vredonosnogo-git-repozitoriya"},"modified":"2026-11-12T11:42:03","modified_gmt":"2026-11-12T09:42:03","slug":"git-vulnerability-allows-code-execution-when-cloning-a-malicious-git-repository","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/git-vulnerability-allows-code-execution-when-cloning-a-malicious-git-repository","title":{"rendered":"Kwetsbaarheid in Git, waardoor code kan worden uitgevoerd bij het clonen van een kwaadaardig Git-repository","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases of the distributed version control system Git 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2 have been published to address 6 vulnerabilities. The most critical vulnerability (CVE-2026-111760) allows code execution when using the \"git clone\" command in the \"--recurse-submodules\" mode with repositories controlled by an attacker.<\/p>\n
The issue is caused by the fact that the length of a name record in the index is calculated using a 32-bit integer type. When a very long name like \".git\/...\" is passed, it results in an integer overflow, allowing the attacker to calculate a length of just 4 bytes. Consequently, during the value check, the actual data is used, while the truncated version \".git\" is executed, which lets the attacker replace the \".git\" file in the submodule with a symbolic link pointing to a directory containing the settings and hooks.<\/p>\n
Andere kwetsbaarheden:<\/p>\n
\n
CVE-2026-113408 \u2014 directory traversal through the use of a symbolic link for the HEAD branch with the value \"refs\/heads\/..\/..\/....\/TARGET\" while cloning an empty repository via Git v2 protocol. Subsequently executing \"git commit\" will create a TARGET file at the root of the repository, which can be exploited for overwriting files in the repository and executing code.\n
CVE-2026-114467 \u2014 stack overflow when removing GPG signatures, which may potentially lead to arbitrary code execution. The issue arises because the remove_signature() function stores the positions of signatures in a fixed array meant for a maximum of two signatures. When a tag with three or more signatures is passed, data is stored outside the bounds of the array.\n
CVE-2026-114469 \u2014 while checking limits on binary patch sizes, data prior to unpacking compressed data was considered, leading to reading contents from out of bounds of the buffer.\n
CVE-2026-105437 \u2014 memory corruption during large merge operations due to accumulated result size in a field of type int. In the GitLab configuration, this vulnerability can be exploited for code execution (the issue is blocked in GitLab 19.5.4).\n
CVE-2026-114466 \u2014 arbitrary file overwriting in the filesystem through the \"git fast-import\" command due to incomplete mitigation of the vulnerability CVE-2019-1348.\n<\/ul>\n