Git Security Update: Why Your CI Runners Need Patching Too

On November 10, the Git project released fixes for six vulnerabilities. One can allow code execution when a malicious repository is cloned recursively. The affected component is Git itself, so the inventory must include developer machines, CI runners and applications that bundle their own Git.

What the release fixes

GitHub’s announcement identifies CVE-2026-111760 in recursive clones and CVE-2026-113408 in a server’s advertised HEAD. The other issues affect signed-tag merges, binary patches, large merges and fast-import streams. Their consequences differ: do not assume that every issue allows remote code execution.

Install Git 2.56.1 or the patched release for your maintenance series: 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 or 2.50.2. Check your distributor’s advisory and any backports; update applications with bundled Git as well.

A practical response

1. Inventory Git versions on workstations, build images, CI runners and services that process repositories.
2. Patch using the trusted distributor for each environment, rebuild images and verify the version actually running.
3. Until patched, avoid recursive clones from untrusted repositories and untrusted merges, binary patches and fast-import streams. These precautions do not replace the update.
4. Record ownership and track remediation; a repository scan alone does not establish the Git version used by a runner.

Where Plexicus fits

Plexicus remediation helps teams follow up on validated application-security findings. This release also needs an infrastructure patching workflow: do not assume an application scan updates Git installations.

Thumbnail: Git logo by Jason Long, CC BY 3.0; unmodified original logo composited over an editorial background.