Executive brief
go-git is a software library used by developers to build Git-related features into their applications. A security flaw in how the library handles file paths allows a malicious repository to write files outside of the intended folder during a checkout or clone operation. This could allow an attacker to corrupt the repository's internal configuration or overwrite sensitive files on a user's system if they interact with a malicious repository.
Technical details
A path traversal vulnerability (CWE-22) exists in go-git due to insufficient path validation during repository operations. The library failed to maintain parity with upstream Git's security checks, allowing maliciously crafted repository payloads to resolve paths outside of the intended worktree. Depending on the operating system (Windows, macOS, or Linux) and the filesystem implementation used (e.g., osfs vs memfs), an attacker can overwrite files in the parent directory or manipulate the repository's internal .git metadata and submodules. Exploitation requires a user to interact with a malicious repository. The issue is resolved in versions 5.19.1 and 6.0.0-alpha.4.
Affected products
- go-git go-git/v5 <= 5.19.0
- go-git go-git/v6 <= 6.0.0-alpha.3
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published by maintainers.
- 2026-05-27: disclosed: CVE published to NVD.