[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUIpCA9Y8kEcY1e7lMkcp-3Rdtpyl92b2FL6CeFZOi7M":3},{"article":4,"iocs":41,"watch_terms":61,"solutions":62,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"af283546-a931-43a8-a6c4-80fe2e03354c","Git fixes six vulnerabilities, including code execution during recursive clones","git-fixes-six-vulnerabilities-including-code-execution-during-recursive-clones-46b23e","The Git project has released security updates addressing six vulnerabilities that could allow attackers to execute code, write to unintended files or cause memory corruption when Git processes malicious repositories or other specially prepared input. Code execution during cloning A vulnerability tracked as CVE-2026-111760 stems from an integer truncation in Git’s handling of its index. An extremely long file path can pass Git’s safety checks under one name and then be written under a shorter … More → The post Git fixes six vulnerabilities, including code execution during recursive clones appeared first on Help Net Security.","The Git project has released security updates addressing six vulnerabilities. These flaws could allow attackers to execute code, write to unintended files, or cause memory corruption when Git processes malicious repositories or specially prepared input. The patches are available in Git 2.56.1 and backported to several older series, with GitHub also deploying fixes across its services.","Git fixes six vulnerabilities, including code execution during recursive clones.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Fgit-project-security-updates\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002F15132604\u002Fshield-secure.webp","2026-11-11T14:26:12+00:00","2026-11-11T15:00:25.598903+00:00",8,[17,20],{"name":18,"type":19},"Git","product",{"name":21,"type":22},"GitHub","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[42,46,49,52,55,58],{"type":43,"value":44,"context":45},"cve","CVE-2026-111760","Code execution during cloning vulnerability",{"type":43,"value":47,"context":48},"CVE-2026-113408","Vulnerability when cloning an empty repository over v2 protocol",{"type":43,"value":50,"context":51},"CVE-2026-114467","Vulnerability in Git's code for stripping GPG signatures",{"type":43,"value":53,"context":54},"CVE-2026-114469","Vulnerability concerning binary patches",{"type":43,"value":56,"context":57},"CVE-2026-105437","Vulnerability in Git's merge machinery",{"type":43,"value":59,"context":60},"CVE-2026-114466","Vulnerability affecting git fast-import",[21,18],{"controls":63,"vendors":151},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":123,"name":124,"problem":125,"products":126},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[152],{"slug":153,"name":21,"logo_path":154,"roles":155},"github","\u002Fvendor-logos\u002Fgithub.png",[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":167},"git-patches-six-flaws-including-remote-code-execution-via-malicious-repositories","Git Patches Six Flaws Including Remote Code Execution via Malicious Repositories","The Git project disclosed six vulnerabilities that could allow attackers to execute arbitrary code, corrupt memory, or write files to unintended locations when a user clones or interacts with a maliciously crafted repository. These flaws are particularly dangerous because developers routinely clone repositories from untrusted or semi-trusted sources, often as part of automated CI\u002FCD pipelines, meaning exploitation can occur with minimal user interaction. The availability of patches in Git 2.56.1 and backported versions means organizations must act quickly to update all environments where Git is installed, including developer workstations, build servers, and cloud-hosted pipelines. Delayed patching leaves development infrastructure exposed to supply-chain-style attacks that could compromise source code, credentials, or entire build outputs.",[162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(e)":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management (v8)":171,"CIS Control 2: Inventory and Control of Software Assets (v8)":172},"This point covers security in acquisition, development, and maintenance including vulnerability handling, which applies because Git is a core development tool and these flaws require timely patching within the development pipeline.","SI-2 requires identifying, reporting, and correcting information system flaws, which maps directly to applying the Git 2.56.1 security patches across all affected systems.","Running unpatched versions of Git—a foundational development dependency—is precisely the scenario this category warns against, as exploitable flaws in toolchain components can compromise entire applications.","This control requires organizations to track and remediate known vulnerabilities on a risk-prioritized schedule, directly addressing the need to patch these six Git flaws promptly.","Knowing every location where Git is installed is a prerequisite for rapid patching; without this inventory, organizations cannot confirm full coverage of the fix."]