# Organizations Restrict Git Recursive Clones

Git’s November 10, 2026 advisory warns that CVE-2026-111760 may allow remote code execution when recursively cloning attacker-controlled repositories. As of November 15, Git lists all versions as affected and has not released a patch. Government agencies, prime contractors, and subcontractors that use Git in development or automated workflows should treat recursive cloning from untrusted sources as a software supply-chain risk.

- Organizations should inventory developer and automated workflows that use recursive clones, pause use with untrusted sources, and document approved exceptions, as advised in the signal.
- Assign an owner to monitor Git’s advisory for a fix; the signal identifies no patch or remediation deadline.
- Procurement and security teams can use the advisory to assess whether software development and delivery workflows supporting government work rely on affected Git operations.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 15, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Sources
- [Git recursive clone risk: interim controls - Brandefense](https://brandefense.io/security-news/git-recursive-clone-risk-cve-2026-111760) - Brandefense