VULNERABILITY INTELLIGENCE

CVE-2026-71556

CVSS score7.1 HIGH
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-08-07
Last modified2026-09-10
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Weakness classification

  • security-advisories@github.com: CWE-59

Primary references