go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
References
| Link | Resource |
|---|---|
| https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Jun 2026, 18:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96 - Vendor Advisory | |
| First Time |
Go-git Project
Go-git Project go-git |
|
| CPE | cpe:2.3:a:go-git_project:go-git:6.0.0:alpha2:*:*:*:go:*:* cpe:2.3:a:go-git_project:go-git:6.0.0:alpha3:*:*:*:go:*:* cpe:2.3:a:go-git_project:go-git:6.0.0:alpha1:*:*:*:go:*:* cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:* |
27 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 15:16
Updated : 2026-06-04 18:01
NVD link : CVE-2026-45571
Mitre link : CVE-2026-45571
CVE.ORG link : CVE-2026-45571
JSON object : View
Products Affected
go-git_project
- go-git
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')