Is CVE-2026-71556 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71556 being exploited in the wild.

How severe is CVE-2026-71556?

High severity, with a CVSS score of 7.1, published 7 August 2026.

Which products and versions are affected?

github.com/go-git/go-git/v5 (Go) <= 5.19.1, SEMVER:introduced=0,fixed=5.19.2; github.com/go-git/go-git/v6 (Go) <= 6.0.0-alpha.4, SEMVER:introduced=0,fixed=6.0.0-alpha.5; Go-Git <= 5.19.1.

Is there a fix for CVE-2026-71556?

Yes. github.com/go-git/go-git/v5 (Go): upgrade to 5.19.2 or later; github.com/go-git/go-git/v6 (Go): upgrade to 6.0.0-alpha.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71556 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71556?

Check whether you run github.com/go-git/go-git/v5 (Go), github.com/go-git/go-git/v6 (Go) or Go-Git at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71556: go-git symlink traversal in worktree operations

Q: Is there a fix for CVE-2026-71556?

Yes. github.com/go-git/go-git/v5 (Go): upgrade to 5.19.2 or later; github.com/go-git/go-git/v6 (Go): upgrade to 6.0.0-alpha.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71556 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-71556?

Check whether you run github.com/go-git/go-git/v5 (Go), github.com/go-git/go-git/v6 (Go) or Go-Git at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71556 · Severity: high · CVSS 7.1 · Published 2026-08-07

A vulnerability in the go-git library, which is used by applications to interact with Git repositories, could allow an attacker to modify files outside of the intended project directory. By tricking an application into writing to a specially crafted symbolic link, an attacker could overwrite critical system files or the repository's own configuration. This could lead to unauthorized data modification or a disruption of service.

Technologies: github.com/go-git/go-git/v5 (Go), github.com/go-git/go-git/v6 (Go), Go-Git. Vendors: Go, Go-Git.

Quick answers

Is CVE-2026-71556 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71556 being exploited in the wild.
How severe is CVE-2026-71556?: High severity, with a CVSS score of 7.1, published 7 August 2026.
Which products and versions are affected?: github.com/go-git/go-git/v5 (Go) <= 5.19.1, SEMVER:introduced=0,fixed=5.19.2; github.com/go-git/go-git/v6 (Go) <= 6.0.0-alpha.4, SEMVER:introduced=0,fixed=6.0.0-alpha.5; Go-Git <= 5.19.1.
Is there a fix for CVE-2026-71556?: Yes. github.com/go-git/go-git/v5 (Go): upgrade to 5.19.2 or later; github.com/go-git/go-git/v6 (Go): upgrade to 6.0.0-alpha.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71556 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71556?: Check whether you run github.com/go-git/go-git/v5 (Go), github.com/go-git/go-git/v6 (Go) or Go-Git at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/go-git/go-git/v5 (Go): upgrade to 5.19.2 or later
```
go get github.com/go-git/go-git/v5@v5.19.2
```
github.com/go-git/go-git/v6 (Go): upgrade to 6.0.0-alpha.5 or later
```
go get github.com/go-git/go-git/v6@v6.0.0-alpha.5
```

Technical details

A symlink traversal vulnerability (CWE-59) exists in go-git's worktree implementation. While the `worktreeFilesystem` wrapper successfully validated path strings for dangerous components like '..' or '.git', it failed to prevent the underlying filesystem from following existing symbolic links within the worktree. An attacker who can introduce a symbolic link into the repository can cause subsequent write operations to resolve to paths outside the worktree, such as the `.git/config` file or other sensitive system locations. This issue affects filesystem-backed worktrees and has been patched in versions 5.19.2 and 6.0.0-alpha.5 by enforcing symlink-safe boundaries during path resolution.

Affected products

go-git go-git/v5 <= 5.19.1
go-git go-git/v6 <= 6.0.0-alpha.4

Identifiers

CVE-2026-71556
GHSA-hc8v-wwc9-vgxm
GO-2026-6213

Timeline

2026-07-30: disclosed
2026-08-07: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.