PT-2026-41959 · Go-Git · Go-Git

Ayushparkara + 1 · Published 2026-05-19 · Updated 2026-05-27 · CVE-2026-45571

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions go-git versions prior to v5

Description A path validation issue allows crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. This occurs because the software drifted from validation checks implemented in upstream Git. Some attack vectors are platform-specific, affecting only Windows or macOS users, while others apply across all supported platforms. Isolation may be provided if non-descendant go-billy filesystem instances or different filesystem types are used for the Storer and Worktree, such as using memfs for the .git directory and osfs for the worktree. However, this isolation may not apply to repositories containing submodules, as submodule dotgit directories may still be materialized within the worktree context.

Recommendations Upgrade to a supported go-git version v5 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-45571

GHSA-CRHJ-59GH-8X96

OPENSUSE-SU-2026:10831-1

Affected Products

Go-Git

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-45571 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10831-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crhj-59gh-8x96 · Vendor Advisory
• https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96 · Note
• https://github.com/go-git/go-git · Note
• https://suse.com/security/cve/CVE-2026-45571 · Note
• https://suse.com/security/cve/CVE-2026-45570 · Note
• https://twitter.com/stansecure/status/2058055759875735720 · Twitter Post