CVE-2026-71556
HighCVSS 7.1Summary
go-git prior to versions 5.19.2 and 6.0.0-alpha.5 has a vulnerability where worktree operations (checkout, status, add) resolve symbolic links without confining resolution to the worktree boundary. A maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory.
Risk Assessment
An attacker can exploit a malicious repository to read or write files outside the working directory, potentially leading to data confidentiality or integrity breaches.
Recommendation
Upgrade go-git to version 5.19.2 or 6.0.0-alpha.5, which fix this issue.
Other vulnerabilities in go-git
See all- CVE-2026-71557Medium
go-git is a git implementation library in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths, so a maliciously crafted reference name can cause writes outside the intended directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
- CVE-2026-34165Medium
In the go-git library (pure Go git implementation) versions 5.0.0 to before 5.17.1, a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory. This issue has been patched in version 5.17.1.
- CVE-2026-33762Low
go-git is a pure Go Git implementation library. Prior to version 5.17.1, the index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4; earlier formats (v2 and v3) are not vulnerable.
Original NVD description (English source)
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.