Link following in Git - CVE-2026-111760
Published: November 12, 2026
Vulnerability identifier: #VU165961
CSH Severity: Medium
CVSS v4: 7.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111760
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on a victim's system.
The vulnerability exists due to improper symbolic link handling in Git's submodule cloning logic when processing recursive clones. A remote user can trick a victim into cloning a specially crafted, attacker-hosted repository with --recurse-submodules to execute arbitrary code by replacing a submodule gitfile with a symbolic link to a directory containing malicious configuration or hooks.
Affected software
Git
How to mitigate CVE-2026-111760
Install security update from vendor's website.
Git - addressed in versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1