GitHub Blog (Git security announcements)
github-blog-git · A · candidate
https://github.blog/open-source/git/
The Git project coordinated security releases are explained here with per-CVE mechanism, fixed versions and GitHub Enterprise Server builds; the 2026-11-10 release was dropped by one fire and missed by the rest because no source in the store follows Git itself. | Fetch: `extract <URL>` of the announcement post. | Added 2026-11-14 as a candidate (promote to active after 3 contributing runs).
Cited in 5 entries
Citation cadence
Citation days per ISO week (26 weeks of coverage span, total 5).
- CVE-2026-105437, GitLab self-managed 19.5.4, 19.4.6 and 19.3.8 critical patch release: a heap overflow in Git's merge code that a user who can open a merge request can trigger for command execution as the git user on the Gitaly node; Git 2.56.1 also fixes CVE-2026-111760, code execution when a malicious repository is cloned with submodules; no exploitation reported2026-11-14
- Gheist: stolen GitHub tokens plant a secret-dumping workflow in every repository they reach; GitHub's July approval hold stops it on public github.com repositories but not on private ones or GitHub Enterprise Server2026-10-27
- "Cordyceps"; the GitHub Actions pull_request_target pwn-request class is still widely exploitable at scale2026-06-25
- npm v12 will disable install scripts by default, audit CI/CD pipelines before July2026-06-12
- npm ships 2FA-gated "staged publishing" GA in response to the 2026 supply-chain worm waves2026-05-24