Executive brief
go-git is a library used by developers to interact with Git repositories in the Go programming language. A vulnerability in how it handles malformed data could allow an attacker to trick the system into verifying a digital signature for a commit that has actually been modified. This could lead to the acceptance of unauthorized code changes or falsified author information in software development workflows.
Technical details
The vulnerability arises from go-git's improper parsing of malformed Git commit or tag objects, which differs from the behavior of the standard Git implementation. Specifically, go-git's signing and verification logic operates on reconstructed data from its internal parsed representation rather than the original raw bytes. An attacker can craft objects with ambiguous or malformed headers that go-git interprets differently than upstream Git. This discrepancy allows for a signature to appear valid even if the displayed metadata (like author or commit message) differs from what was originally signed. The issue is fixed in versions 5.19.0 and 6.0.0-alpha.3.
Affected products
- go-git go-git/v5 < 5.19.0
- go-git go-git/v6 >= 6.0.0-alpha.1, <= 6.0.0-alpha.2
Timeline
- 2026-05-06: disclosed
- 2026-05-11: advisory