go-git vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Latest go-git vulnerabilities

CVE-2026-71557 — go-git: Malicious reference names may modify files outside the reference storage (CVSS 6.3)
CVE-2026-71556 — go-git: Worktree operations may follow symlinks (CVSS 7.1)
CVE-2026-45571 — go-git: Crafted repositories may modify main and submodule .git directories (CVSS 5.4)
CVE-2026-45570 — go-git: Improper single-quote escaping in go-git SSH transport (CVSS 9.6)
CVE-2026-45022 — go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git (CVSS 7.5)
CVE-2026-41506 — go-git Credential leak via cross-host redirect in smart HTTP transport (CVSS 7.4)
CVE-2026-34165 — go-git: Maliciously crafted idx file can cause asymmetric memory consumption (CVSS 5.0)
CVE-2026-33762 — go-git: Missing validation decoding Index v4 files leads to panic (CVSS 2.8)
CVE-2026-25934 — go-git improperly verifies data integrity values for .idx and .pack files (CVSS 4.3)
CVE-2025-21614 — go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVSS 7.5)
CVE-2025-21613 — go-git has an Argument Injection via the URL field (CVSS 9.8)
CVE-2023-49569 — Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients (CVSS 9.8)
CVE-2023-49568 — Maliciously crafted Git server replies can cause DoS on go-git clients (CVSS 7.5)