Skip to main content

Go Git CVE-2025-21613

CRITICAL
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
2025-01-06 security-advisories@github.com
Code Injection Red Hat Go Git Suse Go Git Project
9.2
CVSS 4.0 · GitHub Advisory
View

Vulnerability Assessment

Weakness
CWE
CWE-88
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
Impact

CVSS score of 9.2 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 2.94%.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the critical-severity affected system.
This Week Schedule remediation this week. Why: CRITICAL severity.
Patch available 2.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

go-git is a highly extensible git implementation library written in pure Go. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected Packages

go github.com/go-git/go-git/v4 no fix
go github.com/go-git/go-git/v5 fix: 5.13.0
go gopkg.in/src-d/go-git.v4 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-88. go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0. Affected products include: Go-Git Project Go-Git.

Know when Go Git gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear
SUSE 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.1 HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jan 06, 2025 - 17:15 nvd
CRITICAL 9.2

DescriptionGitHub Advisory

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Executive ViewAI

Why It Matters

Organizations using pure Go. An argument injection vulnerability was discovered in go-git face critical risk from CVE-2025-21613 rated CVSS 9.2. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
2.9%
Top 14% exploitable

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 2.9%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: +3
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*

More in Go Git

View all
CVE-2026-71556 HIGH POC
7.1 Aug 07

Symlink traversal in go-git's worktree filesystem layer allows a maliciously crafted repository to cause write operation
CVE-2023-49569 CRITICAL
9.8 Jan 12

A path traversal vulnerability was discovered in go-git versions prior to v5.11. Rated critical severity (CVSS 9.8), thi
CVE-2026-71557 MEDIUM POC
6.3 Aug 07

Path traversal in go-git's filesystem-backed reference storage allows a malicious Git server to overwrite arbitrary file
CVE-2023-49568 HIGH
7.5 Jan 12

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. Rated high severity (CVSS 7.5)
CVE-2026-41506 MEDIUM
4.7 May 08

go-git versions prior to 5.18.0 and 6.0.0-alpha.2 leak HTTP authentication credentials when following cross-host redirec
CVE-2026-25934 MEDIUM
4.3 Feb 09

Corrupted Git pack and index files are not properly validated in go-git versions before 5.16.5, allowing an attacker to

CVE-2025-21614 HIGH
7.5 Jan 06

go-git is a highly extensible git implementation library written in pure Go. Rated high severity (CVSS 7.5), this vulner

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all
CVE-2016-10033 CRITICAL POC
9.8
CVE-2026-24061 CRITICAL POC
9.8
CVE-2026-86060 CRITICAL POC
9.2
CVE-2025-57791 MEDIUM POC
6.9
CVE-2018-17456 CRITICAL POC
9.8
CVE-2018-19518 HIGH POC
7.5
CVE-2025-70327 CRITICAL POC
9.8
CVE-2020-5792 HIGH POC
7.2

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.13 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.35 Affected
Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.37 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.22 Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2024:6122 ADVISORY https://access.redhat.com/errata/RHSA-2025:0401 ADVISORY https://access.redhat.com/errata/RHSA-2025:0444 ADVISORY https://access.redhat.com/errata/RHSA-2025:0445 ADVISORY https://access.redhat.com/errata/RHSA-2025:0654 ADVISORY https://access.redhat.com/errata/RHSA-2025:0662 ADVISORY https://access.redhat.com/errata/RHSA-2025:0715 ADVISORY https://access.redhat.com/errata/RHSA-2025:0754 ADVISORY https://access.redhat.com/errata/RHSA-2025:0907 ADVISORY https://access.redhat.com/errata/RHSA-2025:1119 ADVISORY https://access.redhat.com/errata/RHSA-2025:11396 ADVISORY https://access.redhat.com/errata/RHSA-2025:1334 ADVISORY https://access.redhat.com/errata/RHSA-2025:1468 ADVISORY https://access.redhat.com/errata/RHSA-2025:1704 ADVISORY https://access.redhat.com/errata/RHSA-2025:1869 ADVISORY https://access.redhat.com/errata/RHSA-2025:1870 ADVISORY https://access.redhat.com/errata/RHSA-2025:1888 ADVISORY https://access.redhat.com/errata/RHSA-2025:3069 ADVISORY https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0056/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0060/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0191/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0277/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0601/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0622/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0623/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0624/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14624/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14654/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14658/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14713/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14752/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy