{"id":"CVE-2026-71557","title":"go-git is an extensible git implementation library written in pure Go","summary":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciou…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","cwe":["CWE-22"],"vendor":"go-git","product":"github.com/go-git/go-git/v5","affected":["github.com/go-git/go-git/v5 <= 5.19.1","github.com/go-git/go-git/v6 <= 6.0.0-alpha.4"],"patched":["github.com/go-git/go-git/v5 5.19.2","github.com/go-git/go-git/v6 6.0.0-alpha.5"],"published":"2026-08-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:41:33.140","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71557","references":[{"url":"https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/pull/2247","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/pull/2254","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/releases/tag/v5.19.2","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-qgq7-7hm3-q39j"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71557.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71557"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512557"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71557"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71557"},{"url":"https://access.redhat.com/errata/RHSA-2026:68806"},{"url":"https://access.redhat.com/errata/RHSA-2026:66208"},{"url":"https://access.redhat.com/errata/RHSA-2026:68808"},{"url":"https://access.redhat.com/errata/RHSA-2026:68281"}],"tags":["nvd","exploit-available","ghsa","go","csaf","vex","red-hat"],"epss":0.00413,"epssPercentile":0.35444,"exploits":{"github":2,"githubRepos":["https://github.com/Saku0512/CVE-2026-71557-poc","https://github.com/Saku0512/reprokit-go-git-cve-2026-71557-lab"],"checkedAt":"2026-10-27T19:10:25.446Z"},"exploitAvailable":true,"aliases":["GHSA-qgq7-7hm3-q39j"],"ecosystem":"go","ingestedAt":"2026-08-07T17:15:34.157Z","slug":"CVE-2026-71557","body":"## Overview\n\ngo-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71557)\n\nAffected packages:\n\n- `github.com/go-git/go-git/v5 <= 5.19.1`\n- `github.com/go-git/go-git/v6 <= 6.0.0-alpha.4`\n\nPatched in:\n\n- `github.com/go-git/go-git/v5 5.19.2`\n- `github.com/go-git/go-git/v6 6.0.0-alpha.5`\n\nSource: https://github.com/advisories/GHSA-qgq7-7hm3-q39j\n\n## Vendor advisories\n\n- **RHSA-2026:68806** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68806)\n- **RHSA-2026:66208** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66208)\n- **RHSA-2026:68808** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68808)\n- **RHSA-2026:68281** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68281)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Custom Metric Autoscaler operator for Red Hat Openshift, DPU kit for NVIDIA, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71557.json)","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5463,"id":"CVE-2026-71557","ts":1788887284690,"field":"exploit_available","old":"false","new":"true"},{"seq":4346,"id":"CVE-2026-71557","ts":1788886398574,"field":"exploit_available","old":"true","new":"false"},{"seq":3072,"id":"CVE-2026-71557","ts":1788883061768,"field":"exploit_available","old":"false","new":"true"},{"seq":2101,"id":"CVE-2026-71557","ts":1788882466647,"field":"exploit_available","old":"true","new":"false"},{"seq":1167,"id":"CVE-2026-71557","ts":1788881903429,"field":"exploit_available","old":"false","new":"true"}]}