Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A flaw in Git can let a malicious repository run an attacker’s code on a computer that clones it recursively, together with its submodules. The Git project fixed the flaw, tracked as CVE-2026-111760 and caused by an integer truncation in how Git handles its index, in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series.