Is CVE-2026-71557 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71557 being exploited in the wild.

How severe is CVE-2026-71557?

Medium severity, with a CVSS score of 6.3, published 7 August 2026.

Which products and versions are affected?

github.com/go-git/go-git/v5 (Go) <= 5.19.1, SEMVER:introduced=0,fixed=5.19.2; github.com/go-git/go-git/v6 (Go) <= 6.0.0-alpha.4, SEMVER:introduced=0,fixed=6.0.0-alpha.5; Go-Git <= 5.19.1.

Is there a fix for CVE-2026-71557?

Yes. github.com/go-git/go-git/v5 (Go): upgrade to 5.19.2 or later; github.com/go-git/go-git/v6 (Go): upgrade to 6.0.0-alpha.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71557 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71557?

Check whether you run github.com/go-git/go-git/v5 (Go), github.com/go-git/go-git/v6 (Go) or Go-Git at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71557: go-git path traversal via malicious reference names

Q: Is there a fix for CVE-2026-71557?

Yes. github.com/go-git/go-git/v5 (Go): upgrade to 5.19.2 or later; github.com/go-git/go-git/v6 (Go): upgrade to 6.0.0-alpha.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71557 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-71557?

Check whether you run github.com/go-git/go-git/v5 (Go), github.com/go-git/go-git/v6 (Go) or Go-Git at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71557 · Severity: medium · CVSS 6.3 · Published 2026-08-07

A vulnerability in the go-git library, which is used by applications to interact with Git repositories, could allow a malicious Git server to manipulate files on a user's system. By providing specially crafted reference names during a clone or fetch operation, an attacker can write data to locations outside the intended storage area, potentially corrupting repository configuration or other sensitive metadata. This risk primarily affects applications that store Git data on a local disk rather than in memory.

Technologies: github.com/go-git/go-git/v5 (Go), github.com/go-git/go-git/v6 (Go), Go-Git. Vendors: Go, Go-Git.

Quick answers

Is CVE-2026-71557 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71557 being exploited in the wild.
How severe is CVE-2026-71557?: Medium severity, with a CVSS score of 6.3, published 7 August 2026.
Which products and versions are affected?: github.com/go-git/go-git/v5 (Go) <= 5.19.1, SEMVER:introduced=0,fixed=5.19.2; github.com/go-git/go-git/v6 (Go) <= 6.0.0-alpha.4, SEMVER:introduced=0,fixed=6.0.0-alpha.5; Go-Git <= 5.19.1.
Is there a fix for CVE-2026-71557?: Yes. github.com/go-git/go-git/v5 (Go): upgrade to 5.19.2 or later; github.com/go-git/go-git/v6 (Go): upgrade to 6.0.0-alpha.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71557 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71557?: Check whether you run github.com/go-git/go-git/v5 (Go), github.com/go-git/go-git/v6 (Go) or Go-Git at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/go-git/go-git/v5 (Go): upgrade to 5.19.2 or later
```
go get github.com/go-git/go-git/v5@v5.19.2
```
github.com/go-git/go-git/v6 (Go): upgrade to 6.0.0-alpha.5 or later
```
go get github.com/go-git/go-git/v6@v6.0.0-alpha.5
```

Technical details

A path traversal vulnerability (CWE-22) exists in go-git's 'dotgit' reference storage implementation within the storage/filesystem package. The library fails to validate that resolved paths for loose references remain within the .git directory, allowing reference names containing traversal sequences (e.g., 'refs/heads/../../config') to resolve to sensitive files like .git/config. An attacker controlling a Git server can exploit this during clone or fetch operations by advertising malicious reference names. The issue is fixed in versions 5.19.2 and 6.0.0-alpha.5 by implementing strict validation at storage entry points.

Affected products

go-git go-git/v5 <= 5.19.1
go-git go-git/v6 <= 6.0.0-alpha.4

Identifiers

CVE-2026-71557
GHSA-qgq7-7hm3-q39j
GO-2026-6214

Timeline

2026-07-30: patched: Fixes released in v5.19.2 and v6.0.0-alpha.5
2026-08-07: advisory: GitHub Advisory GHSA-qgq7-7hm3-q39j published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.