CVE-2026-71557
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
go-git is a git implementation library in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths, so a maliciously crafted reference name can cause writes outside the intended directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Risk Assessment
An attacker could write files outside the intended directory, potentially leading to overwriting important files, privilege escalation, or repository integrity compromise.
Recommendation
Upgrade go-git to version 5.19.2 or 6.0.0-alpha.5. Sanitize reference names before use.
Original NVD description (English source)
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.