{"id":"EM-20261110-YX90","url":"https://cyber.eventmonitor.net/incident/EM-20261110-YX90/git-vulnerability-cve-2026-111760/","type":"cve","title":"git Vulnerability (CVE-2026-111760)","subtitle":"CVE-2026-111760","subject":"CVE-2026-111760","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-10T19:23:10.000Z","firstSignal":"2026-11-10T18:00:00.000Z","lastSignal":"2026-11-11T14:26:12.000Z","updated":"2026-11-11T15:01:42.885Z","revision":2,"life":[{"status":"Born","at":"2026-11-10T19:23:10.000Z","why":"second independent source: C130 The Hacker News"},{"status":"Developing","at":"2026-11-10T19:23:10.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T18:00:00.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-10T19:23:10.000Z","what":"Born: second source, C130 The Hacker News. Page EM-20261110-YX90 created."},{"at":"2026-11-11T14:26:12.000Z","what":"Source joined: C134 Help Net Security"}],"stages":[{"name":"Disclosed","at":"2026-11-10T18:00:00.000Z","detail":"C41 first to name it"},{"name":"Scored","at":null,"detail":"No CVSS yet"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-10T18:00:00.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T18:00:00.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-111760 (important)","text":"git: Git: Arbitrary code execution via unsafe submodule metadata during recursive clones","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-111760.json"},{"at":"2026-11-10T19:23:10.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones","text":"A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An","url":"https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html"},{"at":"2026-11-11T14:26:12.000Z","source":"C134","sourceName":"Help Net Security","role":"Research & News","severity":2,"title":"Git fixes six vulnerabilities, including code execution during recursive clones","text":"The Git project has released security updates addressing six vulnerabilities that could allow attackers to execute code, write to unintended files or cause memory corruption when Git processes malicious repositories or other specially prepared input. Code execution during cloning A vulnerability tracked as CVE-2026-111760 stems from an integer truncation in Git’s handling of its index. An…","url":"https://www.helpnetsecurity.com/2026/11/11/git-project-security-updates/"}],"crowd":[],"reference":{"nvd":null,"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}