Guide Guides
How to safely clone untrusted Git repositories: submodules, config and CI
On 10 November 2026 the Git maintainers disclosed CVE-2026-111760: a malicious repository can run its own code when cloned with --recurse-submodules. As of 12 November 2026 there is no fixed release. It is the third bug of this kind in two and a half years, so it pays to set up how you clone other people's code to blunt the whole class of attacks - now and after the patch lands.
Key points
- CVE-2026-111760 (CVSS 8.0) affects all Git versions according to the maintainers, and no fixed version exists yet. It is triggered only when cloning an attacker's repository with --recurse-submodules.
- A plain git clone does not fetch submodules. Clone untrusted repos without --recurse-submodules and leave their submodules alone until a fix ships and you know where they point.
- Check whether you have submodule.recurse=true set globally and whether CI fetches submodules of untrusted code (actions/checkout with submodules: true or recursive).
- Inspect untrusted code in a disposable environment with no SSH keys or tokens. Update Git as soon as the fix is out - the previous bug of this type, CVE-2025-48384, ended up in the CISA KEV catalog.
What CVE-2026-111760 is and why it matters
On 10 November 2026 the Git maintainers published advisory GHSA-vp2w-7xxj-jvxr, "Recursive clones are susceptible to Remote Code Execution". An attacker-controlled repository can exploit a bug that makes Git overwrite a submodule's gitfile (the small file that tells Git where the submodule's data lives) with a symbolic link. The link points to a directory containing malicious config or hooks, and Git may then run code of the attacker's choosing.
It is rated CVSS 8.0 (vector AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) - the victim has to clone the attacker's repository themselves. The advisory lists all versions of Git as affected and none as patched; fixes are still being discussed on the git-security mailing list. As a workaround it recommends not cloning repositories from untrusted sources, and says the maintainers believe the bug can only be triggered with --recurse-submodules.
Who should care: developers who try out other people's projects, security analysts pulling code for analysis and, above all, CI/CD pipelines that clone code automatically while holding secrets.
Not the first time: submodules as a recurring entry point
The same area - submodules, symlinks and hooks - has bitten Git twice before:
- CVE-2024-32002 (published 14 May 2024, CVSS 9.0): a crafted repository with submodules tricked Git into writing files into the
.git/directory instead of the submodule's working tree. An attacker could plant a hook that ran while the clone was still in progress, before the user could inspect the code. Fixed in 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2 and 2.39.4; according to the advisory, disabling symlink support (core.symlinks false) also prevented the attack. - CVE-2025-48384 (published 8 July 2025, CVSS 8.0): Git dropped a trailing carriage return when writing config values. A submodule path ending in CR could be checked out to the wrong place and, via a symlink, the submodule's
post-checkouthook could run. Fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1 and 2.50.1. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 25 August 2025.
For the new bug the advisory does not say whether core.symlinks false helps, so don't rely on it.
How to clone an untrusted repository safely
1. Clone without submodules. A default git clone does not initialize submodules - that only happens with --recurse-submodules. Don't use it on untrusted code:
git clone https://example.org/project.git2. Look at what would be fetched. The .gitmodules file in the repository root lists the submodules the project uses and where they come from. Unknown URLs are a reason for caution. Leave the submodules of untrusted projects uninitialized until a fix is released.
3. Make sure Git isn't recursing for you. According to the documentation, submodule.recurse=true turns on --recurse-submodules by default for checkout, fetch, grep, pull, push, read-tree, reset, restore and switch (not for clone itself). Find out whether it is set and where:
git config --show-origin --get-all submodule.recurseIf it prints true, consider turning it off until the fix ships, or use git -c submodule.recurse=0 … for untrusted repositories.
4. Inspect untrusted code in a disposable environment. Our advice from SOC practice: a virtual machine or container without your SSH keys, tokens or cloud credentials. If code does run, there is nothing to steal. The same goes for analysing malware and suspicious repositories like those in the wfx-loot campaign.
5. Disabling hooks is not enough. You can turn hooks off with core.hooksPath=/dev/null, but the advisory mentions malicious config or hooks. Treat it as an extra layer at most, not a replacement for steps 1-4.
What to check in CI/CD
Pipelines are the most sensitive place: they clone automatically and often have tokens for registries and cloud accounts close at hand (as the ARTEX attacks on exposed secrets showed).
- GitHub Actions: the
actions/checkoutaction'ssubmodulesinput defaults tofalse. Find workflows that setsubmodules: trueorrecursiveand confirm they don't process code from outside sources. - Scripts: search pipeline repositories for
--recurse-submodulesandgit submodule update --init. - Secrets: by default
actions/checkoutstores the token in the local Git config (persist-credentials: true). For jobs that don't need to push, set it tofalse.
grep -rnE "recurse-submodules|submodules: *(true|recursive)" .github/ ci/ scripts/(Adjust the directories to your project.)
When the fix is released
- Check the version:
git --version, and on servers and CI images through the package manager too. - Update everywhere untrusted code gets cloned - workstations, build agents, container images. With CVE-2025-48384, less than two months passed between the fix and the KEV listing.
- Keep steps 1-4 in place after patching. Submodule bugs keep coming back.
You can break down the score in our CVSS calculator - paste the vector from the advisory to see why high attack complexity (AC:H) and required user interaction (UI:R) give 8.0 rather than 10.
If you suspect code already ran
If you recursively cloned a repository of unknown origin and see odd behaviour: disconnect the machine from the network, rotate the SSH keys, tokens and passwords reachable from that account (from a different device) and review what it had access to. Organisations can report incidents to their national CERT or cyber security agency - in the US to CISA, in the UK to the NCSC.
Updates
- 12 Nov 2026: Article published. No fixed Git release for CVE-2026-111760 yet (checked in advisory GHSA-vp2w-7xxj-jvxr).
FAQ
Does CVE-2026-111760 affect a plain git clone?
According to the Git advisory, the bug can only be triggered when --recurse-submodules is used. A plain git clone without that option does not initialize or fetch submodules. The maintainers say they believe this is the case rather than that it is proven for every scenario, so treat untrusted repositories with care either way.
Is there a fixed version of Git yet?
Not as of 12 November 2026. Advisory GHSA-vp2w-7xxj-jvxr lists all versions as affected and none as patched; it says patches are being discussed on the git-security mailing list. We will update this article when fixed releases are out.
Will disabling hooks with core.hooksPath protect me?
Only partly. The advisory says the symlink can point to a directory containing malicious config or hooks, so disabling hooks does not cover the config route. The reliable step is not using --recurse-submodules on untrusted repositories.
We use GitHub Actions. Are we exposed?
The actions/checkout action has its submodules input set to false by default, so it does not fetch submodules on its own. The risk appears when a workflow that handles code from outside sources sets submodules: true or recursive, or when a pipeline script runs git clone --recurse-submodules.
Sources
- Git - Security advisory GHSA-vp2w-7xxj-jvxr: Recursive clones are susceptible to Remote Code Execution (CVE-2026-111760, 10 Nov 2026)
- Git - Security advisory GHSA-8h77-4q3w-gfgv (CVE-2024-32002)
- NVD - CVE-2024-32002
- NVD - CVE-2025-48384
- CISA - Known Exploited Vulnerabilities Catalog: CVE-2025-48384
- Git documentation - git-clone, --recurse-submodules
- Git documentation - git-config: submodule.recurse, core.symlinks, core.hooksPath
- GitHub - actions/checkout, submodules input
Spotted a mistake? Let us know and we will correct it openly.
Related
Guide
Data breach: my email or password was leaked – what to do now
An email arrives saying a company you use has “experienced a security incident”. Or you typed your address into Have I Been Pwned and got a red list of breaches. That doesn't mean someone is in your account. It means your details are out there, and sooner or later someone will try to use them: your password on other sites, your email and phone number for targeted scams. Here's what to do right away, what to do this week, and what to watch for in the months after.
Guide
Two-step verification: how to turn it on and which method to choose
A strong password can still leak. Two-step verification (2SV or 2FA) asks for a second check when you log in – a code from an app, a tap on your phone or a security key. It takes a few minutes to set up. Here's where to find it, which method to pick, and how not to lock yourself out if you lose your phone.
Guide
Online grooming: warning signs and what to do
Online grooming is when someone – almost always an adult – uses the internet to build a child's trust so they can sexually exploit them. They often pose as another teenager, flatter, send gifts, ask for photos and try to set up a meeting. In 2023, the US National Center for Missing & Exploited Children received more than 186,800 reports of online enticement, over three times as many as in 2021. Here's how to recognise grooming, what to do the moment you find out, and where to report it.