CVE-2026-45571

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:go-git_project:go-git::::::go::*
	cpe:2.3:a:go-git_project:go-git:6.0.0:alpha1::::go::*
	cpe:2.3:a:go-git_project:go-git:6.0.0:alpha2::::go::*
	cpe:2.3:a:go-git_project:go-git:6.0.0:alpha3::::go::*

History

No history.

Information

Published : 2026-05-27 15:16

Updated : 2026-06-17 10:52

NVD link : CVE-2026-45571

Mitre link : CVE-2026-45571

CVE.ORG link : CVE-2026-45571

JSON object : View

Products Affected

go-git_project

go-git

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-45571", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45571", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T16:03:19.270368Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "go-git", "product": "go-git", "versions": [{"status": "affected", "version": "< 5.19.1"}, {"status": "affected", "version": ">= 6.0.0-alpha.1, < 6.0.0-alpha.4"}]}]}], "published": "2026-05-27T15:16:30.387", "references": [{"url": "https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4."}], "lastModified": "2026-06-17T10:52:13.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "C94C128F-5D94-4A33-B6DA-52E95FC47C7A", "versionEndExcluding": "5.19.1"}, {"criteria": "cpe:2.3:a:go-git_project:go-git:6.0.0:alpha1:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "DE1B5EEF-2491-4FDA-AAD5-338EF0AB58F2"}, {"criteria": "cpe:2.3:a:go-git_project:go-git:6.0.0:alpha2:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "5787291E-E6E5-44DE-AAD4-CD03A7E47DB2"}, {"criteria": "cpe:2.3:a:go-git_project:go-git:6.0.0:alpha3:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "01E7EEBF-CC88-4FE1-ABE8-FDBA04C44816"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}