Git maintainers have shipped a fix for CVE-2026-111760, a flaw where cloning a booby-trapped repository together with its submodules could let that repository's owner run their own code on your machine. The root cause is an integer truncation bug in how Git processes its index file. Patches landed in Git 2.56.1, with backports covering every release line back to 2.50.
// source: thehackernews.com ↗