CVE-2026-111760
Not in KEVNo confirmed exploitation in CISA's catalog yet
What happened
Git fixed an integer truncation flaw in its index handling that allows malicious repositories to execute arbitrary code when cloned recursively with submodules. The vulnerability, CVE-2026-111760, was patched in Git 2.56.1 and backported to versions 2.50.2 through 2.55.1. Users should update immediately to prevent code execution during repository cloning.
From the Intel60 brief of Nov 10, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- HighGit patches integer truncation in recursive cloneNov 10, 2026