Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A vulnerability in Git's index-handling logic allowed an integer truncation flaw to be exploited during recursive clones, enabling attackers to replace a submodule's .git file with a symbolic link pointing to malicious hooks or configurations. This means simply cloning a repository from an untrusted source could result in arbitrary code execution on the developer's machine — without any additional user interaction beyond the clone command itself. Developer workstations are high-value targets because they often hold credentials, signing keys, and access to production pipelines. The risk is amplified in CI/CD environments where recursive clones are automated and run with elevated permissions. Patching to Git 2.56.1 or the relevant backported fix is essential to close this attack vector.