CVE-2026-71556High· 7.1▾ Twilightgo-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resoluti…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/go-git/go-git/v5 <= 5.19.1github.com/go-git/go-git/v6 <= 6.0.0-alpha.4Patched in:
github.com/go-git/go-git/v5 5.19.2github.com/go-git/go-git/v6 6.0.0-alpha.5Source: https://github.com/advisories/GHSA-hc8v-wwc9-vgxm
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56854Medium· 6.8golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions (CVE-2026-56854)
CVE-2026-47699Medium· 6.4Confidential Containers Guest Components provides guest tools and components for confidential container workloads
CVE-2025-4673Medium· 6.8net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)
CVE-2021-33194High· 7.5golang: x/net/html: infinite loop in ParseFragment (CVE-2021-33194)
CVE-2024-1753High· 8.6A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers
CVE-2022-23526High· 7.5helm: Denial of service through schema file (CVE-2022-23526)