Git ships security fixes, including a recursive-clone code execution bug

Git maintainer Junio C Hamano has released Git 2.56.1 and security updates for older maintenance lines back to the 2.43 series, and asked users to upgrade promptly. The coordinated set closes six vulnerabilities. The flaw described in the notes is remote code execution during a recursive clone.

CVE-2026-111760 lets an attacker-controlled repository trick Git into replacing a gitfile, the pointer used for a submodule, with a symbolic link. That link can point at a directory holding malicious configuration or hooks, which Git may then treat as code the attacker specified.

The same releases also address CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469, and CVE-2026-105437. Fixed versions include 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, and 2.56.1. Johannes Schindelin organized the updates. Luke Martin and pwn2addr are credited with finding the vulnerabilities.