Published: · Region: Global · Category: cyber

New Git Vulnerability Lets Malicious Repositories Run Code During Clone, Patching Urged

A Git flaw tracked as CVE‑2026‑111760 allows attacker‑crafted repositories to execute code during recursive clones by abusing submodule hooks, and Git has issued fixes for this and five other vulnerabilities.

A newly disclosed security flaw in Git allows malicious repositories to execute code on a developer’s machine during a clone, creating fresh risk for software teams that routinely pull code from public sources.

The vulnerability, tracked as CVE‑2026‑111760, involves Git’s handling of submodules, the nested repositories that projects often use to incorporate libraries or shared components. According to security researchers, attackers can construct a repository so that when a victim performs a recursive clone, hooks inside those submodules trigger arbitrary code execution on the developer’s system.

Git has released patches that address this flaw and five additional vulnerabilities uncovered in the same review. Users are being urged to update their Git clients and related tools to the latest versions. Any environment where developers clone untrusted or community repositories faces particular exposure.

For individual programmers, the risk comes from everyday workflows. Cloning a repository from a public hosting platform has often been treated as a relatively safe action compared with running a downloaded binary. CVE‑2026‑111760 undermines that assumption. A repository that appears benign can conceal a payload that executes as soon as it is cloned with certain options.

Inside organizations, compromised development machines can become an entry point into wider networks. Workstations used for coding often hold access to private source repositories, internal package registries, cloud infrastructure, and continuous integration systems. If an attacker gains code execution on one of these systems, they can potentially move deeper into the environment or alter software produced there.

The case fits a broader pattern in which attackers target the software development process itself rather than only finished products. By exploiting the tools that assemble code, they aim to influence or inspect software before it ever reaches users.

Git’s central role in modern development makes this more than a niche issue. From open‑source projects to proprietary applications, most code today is managed in Git repositories, so a flaw in Git’s behavior has wide implications.

Security teams will now be watching how quickly major platforms and enterprises deploy the patches, whether any providers adjust default clone settings to reduce risk, and whether defenders detect real‑world attempts to exploit the vulnerability against developers or build systems.

Sources

Related Coverage

GLOBAL

Third-Party Cyber Attack on NEAR AI Exposes Data From 100 Users and 18 Agents

An attacker exploited a remote code execution flaw in SGLang to breach NEAR AI, accessing data from 18 AI agents and roughly 100 user accounts. The incident shows how weaknesses in fast‑moving AI tooling can spill over into the companies that build on top of it, with confidential prompts and outputs potentially exposed.
GLOBAL

Attackers Turn Backup Platforms into Entry Point by Exploiting AhsayCBS Flaws

Attackers have exploited two vulnerabilities in AhsayCBS backup servers, hiding payloads in PNG images, running crypto miners, and installing a Python backdoor tuned to evade sandbox analysis. A related Veeam backup server also showed a suspicious credential query, signaling that core backup tools are being probed as high-value targets.
GLOBAL

U.S. Boycott of UN Human Rights Review Puts Washington at Odds With Global Scrutiny System

The United States left its seat empty in Geneva as the UN Human Rights Council met Tuesday to review its record, becoming the first country to fully boycott the process since the body was created. The move deepens questions about how Washington balances its own human rights obligations with its role as a vocal critic of abuses abroad.
WARNING

Reports: U.S. Soldier Arrested in UK on Suspicion of Spying for Russia

British counterterror police detained a serving U.S. Army soldier in England on Tuesday on suspicion of espionage linked to Russia around 19:20–19:50 UTC, according to multiple open-source reports. A live spy case touching a U.S. service member, a NATO host nation, and Russian intelligence raises immediate questions about compromised plans, technology, and alliance trust at a time of active confrontation with Moscow.
WARNING

Russia Claims First Intercept of U.S. ‘Rusty Dagger’ Cruise Missiles Over Ukraine

Russia’s defense ministry says its air defenses downed four U.S.-made AGM‑188A ‘Rusty Dagger’ cruise missiles in the past 24 hours, the first declared intercepts of the newly supplied weapon in Ukraine. If confirmed, the claim would mark a rapid Russian adaptation cycle to a flagship Western strike system, reshaping expectations for Ukraine’s deep‑strike campaign and future NATO weapons exports.