Git patches six flaws that can let malicious repositories run code
The Git project has patched six vulnerabilities, including a high-severity flaw that can let malicious repositories execute code during recursive cloning. The fixes were announced on November 10, 2026, and they cover unsafe file writes and memory corruption in merges, patches, and fast-import handling. Git vulnerability fixes roll out across release lines The patches ship in Git 2.56.1 and were also backported to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2.…