GitHub said the Git project released version 2.56.1, which fixes six security flaws. One flaw, CVE-2026-111760, is the only one GitHub describes as arbitrary code execution. It works during a recursive clone, which also fetches submodules, or repositories nested inside another. The Hacker News described the chain. A very long path passes Git's length check, then is saved under a shorter name an attacker can set to .git. That swaps a submodule's .git file for a symbolic link, a pointer to another folder. Git runs hooks, programs it starts at set points, from that folder, so the attacker's code runs.
The other five flaws need different things from an attacker. A malicious server can make Git write outside its reference folder. A tag with many signatures, a binary patch or a huge merge can corrupt memory or crash Git. Unsafe fast-import features can read or write files. No source says attackers have used any flaw.
Automation and hosting services take in other people's repositories and merges, so they are where these flaws meet untrusted input. GitLab said servers that run git merge-tree to check merge requests are most likely to be targeted through CVE-2026-105437. Servers that cannot upgrade can set conflict-marker-size=7 in info/attributes. Update to 2.56.1 or your series' patched release, including apps that bundle Git, and avoid recursive clones of untrusted repositories.