CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Git before 2.56.1: code execution when a malicious repository is cloned with --recurse-submodules (symlinked submodule .git with attacker hooks); fixed in Git 2.56.1 and backports

cve · CVE-2026-111760

Coverage
1
first 2026-11-14 → last 2026-11-14
Latest activity
2026-11-14
GitLab critical patch: a merge request can reach a Git heap overflow on Gitaly; update to 19.5.4, 19.4.6 or…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
6
6 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-111760, newest first. Check the date before acting on an older one.

  • Upgrade every self-managed GitLab to 19.5.4, 19.4.6 or 19.3.8 now (self-compiled installs rebuild the Git in Gitaly and the Git at git.bin_path, or move the distribution Git to 2.56.1 or later) and, where that waits, limit who can create projects and sign up, because a user who can open a merge request reaches the flaw and code execution gives access to every repository on the Gitaly node.
    2026-11-14CVE-2026-105437 +1

Defender insights

What each entry about CVE-2026-111760 tells a defender to do, newest first.

2026-11-14NOTABLEGitLab critical patch: a merge request can reach a Git heap overflow on Gitaly; update to 19.5.4, 19.4.6 or 19.3.8

Exposure · detection

Story timeline

  1. 2026-11-14CVE-2026-105437, GitLab self-managed 19.5.4, 19.4.6 and 19.3.8 critical patch release: a heap overflow in Git's merge code that a user who can open a merge request can trigger for command execution as the git user on the Gitaly node; Git 2.56.1 also fixes CVE-2026-111760, code execution when a malicious repository is cloned with submodules; no exploitation reported
    trending-vulnerabilitiesGitLab critical patch: a merge request can reach a Git heap overflow on Gitaly; update to 19.5.4, 19.4.6 or 19.3.8

Hunting pivots

Affected products
GitGitHub Enterprise ServerGitLab Community EditionGitLab Enterprise Edition
Tags
patch-availablercevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionExploitation for Client Execution

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-14/gitlab-critical-patch-git-merge-overflow-cve-2026-105437 · ATT&CK page ↗

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-11-14/gitlab-critical-patch-git-merge-overflow-cve-2026-105437 · ATT&CK page ↗

Entries about Git before 2.56.1: code execution when a malicious repository is cloned with --recurse-submodules (symlinked submodule .git with attacker hooks); fixed in Git 2.56.1 and backports (1)

2026-11-14 · view entry permalink →

NOTABLECVE-2026-105437 +1NATOA2

CVE-2026-105437, GitLab self-managed 19.5.4, 19.4.6 and 19.3.8 critical patch release: a heap overflow in Git's merge code that a user who can open a merge request can trigger for command execution as the git user on the Gitaly node; Git 2.56.1 also fixes CVE-2026-111760, code execution when a malicious repository is cloned with submodules; no exploitation reported

GitLab shipped an ad-hoc critical patch release on 2026-11-10, 19.5.4, 19.4.6 and 19.3.8 for CE and EE, for CVE-2026-105437, a vulnerability in Git that under certain conditions gives out-of-bounds heap writes that could run arbitrary commands in Gitaly's environment; it affects all versions from 16.2 before 19.3.8, 19.4 before 19.4.6 and 19.5 before 19.5.4, while GitLab.com and Dedicated already run a patched version (GitLab, 2026-11-10). GitLab's detection page says any user who can create a project and open a merge request reaches the flaw, which gives command execution as the git operating-system user and read and write access to every repository on that Gitaly node (GitLab, 2026-11-12).

Git 2.56.1 and the backports 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2 of 2026-11-10 fix the same flaw and five others (GitHub Blog, 2026-11-10). The one that matters on workstations and CI runners is CVE-2026-111760: a long path that passes validation is written as .git and replaces a freshly cloned submodule's .git file with a symlink to a directory that holds attacker hooks or configuration, which GitHub says can execute attacker-controlled code during a recursive clone (oss-security, 2026-11-11; GitHub Blog, 2026-11-10). The maintainers believe it is only triggerable with --recurse-submodules and note that such a repository fails fsck, which does not protect downstream users, since an innocuous-looking .gitmodules pointing at it suffices (oss-security, 2026-11-11). GitHub Enterprise Server fixes are in 3.19.15, 3.20.11, 3.21.9 and 3.22.4, and GitHub is coordinating releases of GitHub Desktop and the Copilot app with patched Git (GitHub Blog, 2026-11-10); Git for Windows 2.56.1.windows.1 addresses the issue (Git for Windows, 2026-11-10). No source reports exploitation; GitLab documents a lab reproduction in which opening one merge request left a crash entry within a second and a half (GitLab, 2026-11-12).

In GitLab, under certain conditions, this vulnerability in git can result in out-of-bounds heap writes, which could be used to execute arbitrary commands within GitLab’s Gitaly environment.

Arbitrary command execution in the Gitaly environment, as the git operating system user, by any authenticated user who can create a project.

GitLab
vulnerability14 Nov 04:12Zmulti-sourceOpen finding →
Sources: GitLab (critical patch release 19.5.4, 19.4.6, 19.3.8) · GitHub Blog · oss-security (Git maintainers' announcement) · GitLab (detection guidance) · The Hacker News · Git for Windows

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • docs.gitlab.com1 (17%)
  • github.blog1 (17%)
  • github.com1 (17%)
  • gitlab.com1 (17%)
  • openwall.com1 (17%)
  • thehackernews.com1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)