Go Git
Monthly
Symlink traversal in go-git's worktree filesystem layer allows a maliciously crafted repository to cause write operations to escape the intended worktree boundary when cloned and operated upon. Affected are all filesystem-backed go-git deployments using v5 prior to 5.19.2 and v6 prior to 6.0.0-alpha.5. An attacker who controls a repository can plant symlinks such that a victim's go-git worktree operations (checkout, add, status) silently overwrite files outside the working directory - including critical Git metadata like .git/config - enabling repository poisoning or arbitrary local file corruption. No public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
Path traversal in go-git's filesystem-backed reference storage allows a malicious Git server to overwrite arbitrary files within the `.git` directory - including sensitive metadata like `.git/config` and `.git/HEAD` - by advertising crafted reference names containing `..` sequences. Any application using go-git with the `storage/filesystem` package that clones from or fetches untrusted remote repositories is affected; versions prior to 5.19.2 (v5 branch) and 6.0.0-alpha.5 (v6 branch) are vulnerable. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward and requires only that an attacker control a Git server the victim application connects to.
go-git versions prior to 5.18.0 and 6.0.0-alpha.2 leak HTTP authentication credentials when following cross-host redirects during smart-HTTP clone and fetch operations. Remote unauthenticated attackers controlling a redirect target can capture credentials intended for the original repository host. User interaction (initiating a clone/fetch to a malicious or compromised server) is required. Vendor-released patches are available in v5.18.0 and v6.0.0-alpha.2.
Corrupted Git pack and index files are not properly validated in go-git versions before 5.16.5, allowing an attacker to supply malicious packfiles that bypass integrity checks and cause go-git to consume corrupted data. This can result in unexpected application errors and denial of service conditions for any system using the vulnerable go-git library to fetch or process Git repositories. The vulnerability requires user interaction to fetch from a malicious or compromised Git source.
go-git is a highly extensible git implementation library written in pure Go. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
go-git is a highly extensible git implementation library written in pure Go. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A path traversal vulnerability was discovered in go-git versions prior to v5.11. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Symlink traversal in go-git's worktree filesystem layer allows a maliciously crafted repository to cause write operations to escape the intended worktree boundary when cloned and operated upon. Affected are all filesystem-backed go-git deployments using v5 prior to 5.19.2 and v6 prior to 6.0.0-alpha.5. An attacker who controls a repository can plant symlinks such that a victim's go-git worktree operations (checkout, add, status) silently overwrite files outside the working directory - including critical Git metadata like .git/config - enabling repository poisoning or arbitrary local file corruption. No public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
Path traversal in go-git's filesystem-backed reference storage allows a malicious Git server to overwrite arbitrary files within the `.git` directory - including sensitive metadata like `.git/config` and `.git/HEAD` - by advertising crafted reference names containing `..` sequences. Any application using go-git with the `storage/filesystem` package that clones from or fetches untrusted remote repositories is affected; versions prior to 5.19.2 (v5 branch) and 6.0.0-alpha.5 (v6 branch) are vulnerable. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward and requires only that an attacker control a Git server the victim application connects to.
go-git versions prior to 5.18.0 and 6.0.0-alpha.2 leak HTTP authentication credentials when following cross-host redirects during smart-HTTP clone and fetch operations. Remote unauthenticated attackers controlling a redirect target can capture credentials intended for the original repository host. User interaction (initiating a clone/fetch to a malicious or compromised server) is required. Vendor-released patches are available in v5.18.0 and v6.0.0-alpha.2.
Corrupted Git pack and index files are not properly validated in go-git versions before 5.16.5, allowing an attacker to supply malicious packfiles that bypass integrity checks and cause go-git to consume corrupted data. This can result in unexpected application errors and denial of service conditions for any system using the vulnerable go-git library to fetch or process Git repositories. The vulnerability requires user interaction to fetch from a malicious or compromised Git source.
go-git is a highly extensible git implementation library written in pure Go. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
go-git is a highly extensible git implementation library written in pure Go. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A path traversal vulnerability was discovered in go-git versions prior to v5.11. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.