Which versions contain the fixes?
The Git project released fixes for six vulnerabilities on November 10. The official 2.56.1 release notes identify the same fixes in 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. Install the patched release supplied for your maintenance series or operating system.
Why developers should check
GitHub’s announcement describes risks involving recursive clones of malicious repositories, reference handling, merges, binary patches and imports. The recursive-clone flaw can allow attacker-controlled code to run. These are specific processing paths, not evidence that every repository has been compromised.
Check more than one installation
Update applications that bundle their own Git and installations used by automation or repository-processing services. GitHub says its hosted services have received fixes, while patched GitHub Desktop and Copilot app releases are being coordinated; that does not establish that every desktop installation is already updated.
Until fixes can be installed, GitHub advises using trusted sources and avoiding untrusted recursive clones, merges, tags, binary patches and import streams. Those precautions do not replace updating.
