[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRShcjRZvEtnrYvtHYCu9l2QcbVEq0jkpUgcldMg5bSw":3},{"article":4,"iocs":44,"watch_terms":64,"solutions":65,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"05930bd1-3437-4bd5-8d95-71df7a028946","Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones","git-patches-flaw-that-lets-malicious-repositories-execute-code-during-recursive-98e4d7","A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An","Git has patched a vulnerability (CVE-2026-111760) that allowed malicious repositories to execute attacker code during recursive clones by exploiting an integer truncation flaw in how Git handles its index. The flaw enables an attacker to replace a submodule's .git file with a symbolic link to malicious hooks or configurations. Git versions 2.56.1 and specific patches for older series have been released to address this, along with five other disclosed flaws.","Git fixes flaw allowing malicious repos to execute code during recursive clones.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fgit-patches-flaw-that-lets-malicious.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEipoPlLYj_xfJ8bsfRTONwa3estE9I2un_9OBx2fVuxEp-zoiADgipn-gGOeU4TqqyjqjrCpoGXC4jmuF7o1e_PUMbr-QoHDdPZEDWavb4VbjtWbOxMfmz-E9fIPT2DHEXYCN53l2jtiJGVfEFjHsR8gaHeyF59Yii0oTnP73vaslLWPzuideEGxTy6S9U\u002Fs1600\u002Fgits.jpg","2026-11-10T19:23:10+00:00","2026-11-10T20:00:28.224101+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Git","product",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":19},"GitHub Enterprise Cloud",{"name":26,"type":19},"GitHub Enterprise Server",{"name":28,"type":19},"GitHub Desktop",{"name":30,"type":19},"GitHub Copilot","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},[45,49,52,55,58,61],{"type":46,"value":47,"context":48},"cve","CVE-2026-111760","Integer truncation flaw allowing code execution during recursive clones.",{"type":46,"value":50,"context":51},"CVE-2026-113408","Path traversal vulnerability when cloning empty repositories over Git protocol v2.",{"type":46,"value":53,"context":54},"CVE-2026-114467","Denial of service vulnerability when merging tags with multiple GPG signatures.",{"type":46,"value":56,"context":57},"CVE-2026-114469","Out-of-bounds read vulnerability due to excessively large binary patches.",{"type":46,"value":59,"context":60},"CVE-2026-105437","Heap corruption vulnerability from large merges with many conflicts.",{"type":46,"value":62,"context":63},"CVE-2026-114466","Arbitrary file read or creation vulnerability via git fast-import features.",[21,18,24],{"controls":66,"vendors":150},[67,95,124],{"slug":68,"name":69,"problem":70,"products":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",[72,79,87],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":68,"product_name":76,"url":77,"description":78},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":125,"name":126,"problem":127,"products":128},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[129,137,142],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":138,"product_name":139,"url":140,"description":141},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[151],{"slug":152,"name":21,"logo_path":153,"roles":154},"github","\u002Fvendor-logos\u002Fgithub.png",[155],"reported_by",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":166},"git-integer-truncation-flaw-enables-code-execution-via-malicious-repositories","Git Integer Truncation Flaw Enables Code Execution via Malicious Repositories","A vulnerability in Git's index-handling logic allowed an integer truncation flaw to be exploited during recursive clones, enabling attackers to replace a submodule's .git file with a symbolic link pointing to malicious hooks or configurations. This means simply cloning a repository from an untrusted source could result in arbitrary code execution on the developer's machine — without any additional user interaction beyond the clone command itself. Developer workstations are high-value targets because they often hold credentials, signing keys, and access to production pipelines. The risk is amplified in CI\u002FCD environments where recursive clones are automated and run with elevated permissions. Patching to Git 2.56.1 or the relevant backported fix is essential to close this attack vector.",[161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.PS-01: Configuration Management","NIS2 Article 21(2)(e)","MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools",{"NIS2 Article 21(2)(e)":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"NIST CSF 2.0 PR.PS-01: Configuration Management":169,"CIS Control 7: Continuous Vulnerability Management (v8)":170,"MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools":171},"This point requires security in acquisition, development, and maintenance including vulnerability handling, directly covering the need to track and remediate flaws in development tools such as Git.","SI-2 mandates identifying, reporting, and correcting software flaws in a timely manner, which would have ensured Git was patched before malicious repositories could exploit this vulnerability.","This category calls for maintaining secure configurations of software, which includes keeping developer tooling like Git updated to versions free of known exploitable flaws.","CIS Control 7 requires organizations to continuously assess and remediate known vulnerabilities; applying the Git patch promptly would have directly closed this integer truncation flaw before exploitation.","This technique covers attackers compromising tools used in the software development pipeline; a malicious repository exploiting Git during a recursive clone fits precisely within this attack pattern."]