Source Verification: Read from disk (sources/2026-11/git-2561-.../): source-0 GitHub Blog post by Elijah Newren dated November 10, 2026: confirms six vulnerabilities, 2.56.1 plus 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2, 'arbitrary code execution when recursively cloning a malicious repository', each per-CVE description, GHES 3.19.15/3.20.11/3.21.9/3.22.4, Desktop and Copilot app 'coordinating', Codespaces and Actions 'will also receive', the update and workaround guidance and the 'These precautions do not replace installing the fixes' sentence verbatim. source-1 GHSA-vp2w-7xxj-jvxr: High, 8.0, vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, published Nov 10, 2026, affected 'all', patched 'none', 'Patches are being discussed on the git-security mailing list.', 'We currently believe this can only be triggered when the --recurse-submodules option is used', credits newren (remediation developer), peff and dscho (remediation reviewers), no reporter; the page's Impact text also says the repository is 'hosted by the attacker rather than on a normal forge site' (not in the article, see corrections). source-2 RelNotes 2.50.2 and source-3 RelNotes 2.56.1: the same six identifiers in both, 2.56.1 'merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1, v2.54.1 and v2.55.1'; the 2.50.2 notes use the wording 'Recursive clones are susceptible to Remote Code Execution' and carry the unborn-HEAD example, the more-than-two-signatures merge trigger and the fast-import feature list. Recount: six distinct CVE ids (CVE-2026-111760, -113408, -114466, -114467, -114469, -105437), 2.56.1 plus six backport releases = seven releases; the headline's 'Six Backport Releases' and the body's 'seven releases' are both correct. source-4 The Hacker News (Swati Khandelwal, Nov 10, 2026): confirms the .git-file-versus-folder point, GitLab assigning CVE-2026-105437 and the merge-tree and info/attributes workaround, and its own check that Git for Windows had no 2.56.1-based version 'as of Tuesday at 19:09 UTC'. source-5 NVD: the stored snapshot is an empty JavaScript shell (title 'NVD - Home'), so I read the record by another route: NVD API https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-105437 fetched Nov 11, 2026 10:51 UTC (sha256 of the JSON body 579204554f6e6e9b2baa6bb05e70143bab3ac440bd9ea8d37cf3a1f6c3e461b6): sourceIdentifier [email protected], vulnStatus Received, published and lastModified 2026-11-10T19:17:46.200, CVSS v3.1 7.5 HIGH (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) from source [email protected] (type Secondary), CWE-122. The NVD change history API (cvehistory/2.0) shows a single event, 'New CVE Received', so no NVD analysis score exists and 7.5 is correctly attributed to the GitLab-sourced record. NVD API returns totalResults 0 for the other five identifiers, matching the article's 'no record' statement. The CVE record (cvelistV5, GitLab CNA, published 2026-11-10T18:34:09Z) carries the same 7.5 score. source-6 Git for Windows release page, cross-checked with the GitHub API (repos/git-for-windows/git/releases/tags/v2.56.1.windows.1): published_at 2026-11-10T22:13:20Z, not a pre-release, 'Comes with Git v2.56.1', same six identifiers. source-7 GitHub Desktop release-3.6.12-beta1, GitHub API: published_at 2026-11-11T08:58:37Z, prerelease true, body 'Update embedded Git to 2.56.1'. source-8 Debian Security Tracker: bookworm 2.39.5-0+deb12u3, bookworm (security) deb12u2, trixie, forky and sid all 'vulnerable', unstable '(unfixed)'; the live page fetched Nov 11 10:52 GMT still shows the same table. The page has no machine-readable timestamp; the article marks it as a live-page snapshot and gives 'about 10:23', which falls before the submission time (10:27:02Z) and cannot be independently verified but is consistent. GHSA published time cross-checked with the GitHub advisories API: published_at and updated_at 2026-11-10T19:09:09Z, state published, patched_versions 'none'. All claims in the article trace to these sources. manifest suspicious_patterns: null for all nine; no injection text found. Exploitation: grep for 'in the wild', 'exploited', 'exploitation' across the nine snapshots found nothing, so 'none reports exploitation in the wild' holds for the cited sources. Outside reporter: no cited page names one, but the GitLab-assigned CVE record for CVE-2026-105437 (not cited, cvelistV5 JSON) credits a finder 'taise' reporting through HackerOne, and the cited NVD record's references include a HackerOne Bug Bounty Report #4044249 (hackerone.com/reports/4044249 returns 403, not read); the article's sentence is accurate for the pages it cites but incomplete, filed as a clarification. Independence: The Hacker News is the single independent outlet (editorial publisher, Nov 10); it draws mostly on GitHub's write-up and the release announcement but adds its own check of Git for Windows release tags, the .git file/folder explanation and the GitLab merge-tree and workaround detail, so it is not a bare restatement. Debian is an independent tracker. GitHub Blog, Desktop and GHES are GitHub's own pages (the post's author is a GitHub engineer credited on the advisory). Allowlist: github.blog, github.com, raw.githubusercontent.com, thehackernews.com, nvd.nist.gov and security-tracker.debian.org are all on config/source_allowlist.txt; no additions. Anthropic disclosure: not required - the story concerns Git, GitHub, GitLab and Debian; Anthropic and its products are not the subject and are not mentioned in the headline, summary, lead or any credit line.
Factual Accuracy: Claim-accuracy tests run. (1) Counts: six CVE ids, seven releases, six backports, six identifiers recounted from the release notes; correct. Quantifiers: 'two of the six identifiers carry a CVSS score in the cited sources' (8.0 Git advisory, 7.5 GitLab-sourced NVD) is correct and each score is attributed to its assigner. (2) Headline, summary, lead: 'can run attacker code during recursive clones' matches the advisory and release notes ('Remote Code Execution', 'arbitrary code execution when recursively cloning a malicious repository'), with the --recurse-submodules precondition and the advisory's 'currently believe' hedge kept in the body; the headline does not say all clones or all platforms. Summary's 22:13 UTC Git for Windows time verified by API. (3) Dates and times: Nov 10 GHSA 19:09:09, Git for Windows 22:13:20, Nov 11 Desktop 08:58:37 all match the machine-readable data and are in order; THN's 19:09 check is attributed to THN. (4) Derived figures recomputed (see above). (5) Disagreement: the advisory page ('Patches are being discussed', patched versions none) versus the release notes is reported with its read date and without inventing an explanation. (6) Absence claims: 'none of the cited sources reports exploitation in the wild' verified; 'none names an outside reporter for any of the six' is true of the cited pages but the CVE record for CVE-2026-105437 credits a HackerOne finder, so it is incomplete (clarification). Minor: CVE-2026-114467 described as 'a message' (release notes: 'commit message'/tag); consistent with the sources. The advisory's attacker-hosted-repository wording is omitted (clarification).