[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f88U5_KgIbIFn7ZSR5aVTLl6_1Dc362ws6uezokFOgCg":3},{"article":4,"iocs":54,"watch_terms":76,"solutions":77,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"74cf9c34-0f13-442d-8c14-1061cadaae21","Git Fixes 6 Security Vulnerabilities Allowing Hackers to Execute Malicious Code Through Cloned Repositories","git-fixes-6-security-vulnerabilities-allowing-hackers-to-execute-malicious-code-f69e7b","The Git project patched six vulnerabilities, including a critical flaw that allows malicious repositories to execute code during recursive cloning. The other five involve unsafe file writes and memory corruption in merges and patches. Git announced the fixes on November 10, 2026. The patches arrive in Git 2.56.1. They are also backported to 2.55.1, 2.54.1, […] The post Git Fixes 6 Security Vulnerabilities Allowing Hackers to Execute Malicious Code Through Cloned Repositories appeared first on Cyber Security News.","The Git project has addressed six security vulnerabilities, with the most severe (CVE-2026-111760) allowing malicious code execution during recursive cloning by exploiting an integer truncation in path handling. Other flaws include unsafe file writes, memory corruption in merges and patches, and issues with binary patches and fast-import. Patches are available in Git 2.56.1 and backported versions, with GitHub also implementing fixes.","Git fixes six vulnerabilities, including a critical flaw enabling code execution via cloned repositories.","https:\u002F\u002Fcybersecuritynews.com\u002Fgit-fixes-security-vulnerabilities\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FGit-Fixes-6-Security-Vulnerabilities-Allowing-Hackers-to-Execute-Malicious-Code-Through-Cloned-Repositories.webp","2026-11-11T11:33:03+00:00","2026-11-11T12:00:40.302819+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Git","product",{"name":21,"type":22},"Lazarus Group","threat_actor",{"name":24,"type":19},"GitHub Enterprise Server",{"name":26,"type":19},"GitHub Desktop",{"name":28,"type":19},"GitHub Copilot",{"name":30,"type":19},"Codespaces","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,68,71,74],{"type":56,"value":57,"context":58},"cve","CVE-2026-111760","Critical flaw allowing code execution during recursive cloning.",{"type":56,"value":60,"context":61},"CVE-2026-113408","Affects cloning an empty repository over protocol v2.",{"type":56,"value":63,"context":64},"CVE-2026-114467","Stack memory bug when removing GPG signatures from a message.",{"type":56,"value":66,"context":67},"CVE-2026-114469","Out-of-bounds read and crash in binary patches.",{"type":56,"value":69,"context":70},"CVE-2026-105437","Heap corruption bug in large merges.",{"type":56,"value":72,"context":73},"CVE-2026-114466","File read\u002Fwrite outside repository in git fast-import.",{"type":48,"value":21,"context":75},"Mentioned as a threat actor using a similar symlink trick against developers in a past campaign.",[18,24,26],{"controls":78,"vendors":164},[79,108,137],{"slug":80,"name":81,"problem":82,"products":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":109,"name":110,"problem":111,"products":112},"patch-management","Automated patch management","Known holes get closed in days, not months.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":138,"name":139,"problem":140,"products":141},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[142,148,156],{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":143,"product_name":144,"url":146,"description":147},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":175},"six-git-vulnerabilities-enable-malicious-code-execution-via-cloned-repositories","Six Git Vulnerabilities Enable Malicious Code Execution via Cloned Repositories","Six security vulnerabilities in Git, the world's most widely used version control system, exposed developers and organizations to malicious code execution simply by cloning a repository. The most critical flaw (CVE-2026-111760) exploited an integer truncation in path handling during recursive clones, allowing an attacker to embed a weaponized repository that executes arbitrary code on the victim's machine. Because Git is embedded in virtually every software development pipeline, CI\u002FCD system, and developer workstation, unpatched installations represent an enormous and often overlooked attack surface. This incident underscores the importance of treating foundational developer tooling with the same urgency as production infrastructure when vulnerabilities are disclosed.",[170,171,172,173,174],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(e)":176,"NIST SP 800-53 SI-2: Flaw Remediation":177,"OWASP A06:2021 Vulnerable and Outdated Components":178,"CIS Control 7: Continuous Vulnerability Management (v8)":179,"CIS Control 2: Inventory and Control of Software Assets (v8)":180},"This point specifically covers security in acquisition, development, and maintenance including vulnerability handling, which applies because Git is a core development tool and prompt patch application is required under this obligation.","SI-2 requires organizations to identify, report, and correct information system flaws, directly covering the obligation to apply the Git security patches in a timely manner.","Running unpatched versions of Git—a foundational development dependency—is a textbook instance of the vulnerable and outdated components risk that OWASP A06 addresses.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying the Git 2.56.1 patch promptly is exactly the remediation action this control mandates.","Maintaining an up-to-date inventory of all software, including developer tools like Git, is a prerequisite for identifying which systems are running vulnerable versions and prioritizing patching."]