CVE-2026-111760

{}

{}

{}

{"bugzilla": {"description": "git: Git: Arbitrary code execution via unsafe submodule metadata during recursive clones", "id": "2567365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567365"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Git. Unsafe handling of submodule-related repository metadata during recursive clone operations can lead to arbitrary code execution. A remote attacker could exploit this vulnerability by supplying a crafted repository that triggers unauthorized command execution on the host system when cloned recursively."], "mitigation": {"lang": "en:us", "value": "Avoid performing recursive repository retrieval operations on untrusted sources.\nOperational controls:\n1. Do not use the `--recurse-submodules` or `--recursive` flags when executing `git clone` on untrusted or external repositories.\n2. If submodules are required, clone repositories non-recursively and inspect configuration files, including `.gitmodules`, prior to initializing nested modules.\n3. Isolate repository cloning operations within unprivileged containers or dedicated sandboxes to restrict the impact of potential arbitrary execution.\nCaveats:\nAutomated build processes that rely on automatic retrieval of nested repository structures without recursive flags will require manual verification and isolated processing, which may disrupt automated workflows."}, "name": "CVE-2026-111760", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "rubygem-git", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T18:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111760\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111760"], "statement": "This vulnerability is rated as Important rather than Critical because exploitation requires a specific precondition where a user or automated pipeline initiates a recursive repository retrieval against an untrusted source. In typical Red Hat environments, Git is frequently deployed within CI/CD pipelines and developer workstations, exposing those environments to arbitrary code execution if third-party repositories are processed without verification. Although the blast radius is bounded by the privileges of the executing account, such exploitation could compromise build environments or access tokens.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 70.0, "confidence_source": "inferred", "scores": [{"score": 70.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "git", "vendor": "git"}], "created": "2026-11-11T18:00:10.175010+00:00", "updated": "2026-11-13T03:30:14.025031+00:00", "vendors": ["git", "git$PRODUCT$git"]}