Git: security vulnerabilities

Git

Git releases updates addressing six security vulnerabilities

Do this now

Update Git to 2.56.1, or to 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 or 2.55.1 on those release lines.

Fix it

Git

On 2.50.xUpgrade to Git 2.50.2
On 2.51.xUpgrade to Git 2.51.3
On 2.52.xUpgrade to Git 2.52.1
On 2.53.xUpgrade to Git 2.53.1
On 2.54.xUpgrade to Git 2.54.1
On 2.55.xUpgrade to Git 2.55.1
On 2.56.xUpgrade to Git 2.56.1

First seen: 10 Nov 2026
Last update: 11 Nov 2026, 15:19 UTC
Fixed in: 2.56.1
2.55.1
2.54.1
2.53.1
2.52.1
2.51.3
2.50.2
Identifiers: CVE-2026-111760 ID not published yet
CVSS: 8.0
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Git: security vulnerabilities
Severity: high. Patch status: patched.
Affected: Git
Fixed in: 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2
Ids: CVE-2026-111760

Git releases updates addressing six security vulnerabilities

## Steps
1. Search the repo, its CI and infra config for Git. If present, report the version in use and whether it's affected.
2. Fix by release line: Git: 2.56.1; 2.55.1; 2.54.1; 2.53.1; 2.52.1; 2.51.3; 2.50.2.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Git | fixed | 2.56.1 | — |
| Git | fixed | 2.55.1 | — |
| Git | fixed | 2.54.1 | — |
| Git | fixed | 2.53.1 | — |
| Git | fixed | 2.52.1 | — |
| Git | fixed | 2.51.3 | — |
| Git | fixed | 2.50.2 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-111760") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.helpnetsecurity.com/2026/11/11/git-project-security-updates/
https://pwned.coffee/i/git-security-vulnerabilities

Timeline

11 Nov 2026, 15:17 UTC
Reported by helpnetsecurity.com: Git fixes six vulnerabilities, including code execution during recursive clones
10 Nov 2026, 20:19 UTC
Fix status: unknown → patched.
10 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Checked by hand “Git 2.56.1 and friends, announced 10 Nov 2026 (read 11 Nov 2026): "Git v2.56.1 Release Notes / This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1, v2.54.1 and v2.55.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details."” source
Fix by release line: Product Affected Fixed in Source
Git before 2.56.1 2.56.1 Checked by hand checked 11 Nov
Git before 2.55.1 2.55.1 Checked by hand checked 11 Nov
Git before 2.54.1 2.54.1 Checked by hand checked 11 Nov
Git before 2.53.1 2.53.1 Checked by hand checked 11 Nov
Git before 2.52.1 2.52.1 Checked by hand checked 11 Nov
Git before 2.51.3 2.51.3 Checked by hand checked 11 Nov
Git before 2.50.2 2.50.2 Checked by hand checked 11 Nov
Score: CVSS 8.0 (high). CVSS 3.1 8 (Git’s GitHub advisory GHSA-vp2w-7xxj-jvxr, severity high) for CVE-2026-111760
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
Git	before 2.56.1	2.56.1	Checked by hand checked 11 Nov
Git	before 2.55.1	2.55.1	Checked by hand checked 11 Nov
Git	before 2.54.1	2.54.1	Checked by hand checked 11 Nov
Git	before 2.53.1	2.53.1	Checked by hand checked 11 Nov
Git	before 2.52.1	2.52.1	Checked by hand checked 11 Nov
Git	before 2.51.3	2.51.3	Checked by hand checked 11 Nov
Git	before 2.50.2	2.50.2	Checked by hand checked 11 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

helpnetsecurity.com: Git fixes six vulnerabilities, including code execution during recursive clones

Follow on X

Totalone hot coffee