---
id: CVE-2026-71557
title: go-git is an extensible git implementation library written in pure Go
summary: >-
  go-git is an extensible git implementation library written in pure Go. Prior
  to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being
  used to construct on-disk paths under the reference storage directory, so a
  maliciou…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L'
cwe:
  - CWE-22
vendor: go-git
product: github.com/go-git/go-git/v5
affected:
  - github.com/go-git/go-git/v5 <= 5.19.1
  - github.com/go-git/go-git/v6 <= 6.0.0-alpha.4
patched:
  - github.com/go-git/go-git/v5 5.19.2
  - github.com/go-git/go-git/v6 6.0.0-alpha.5
published: '2026-08-07'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:41:33.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71557'
references:
  - url: >-
      https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7
    label: security-advisories@github.com
  - url: >-
      https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/pull/2247'
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/pull/2254'
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/releases/tag/v5.19.2'
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5'
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qgq7-7hm3-q39j'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71557.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71557'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512557'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71557'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71557'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68806'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66208'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68808'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68281'
tags:
  - nvd
  - exploit-available
  - ghsa
  - go
  - csaf
  - vex
  - red-hat
epss: 0.00413
epssPercentile: 0.35444
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/Saku0512/CVE-2026-71557-poc'
    - 'https://github.com/Saku0512/reprokit-go-git-cve-2026-71557-lab'
  checkedAt: '2026-10-27T19:10:25.446Z'
exploitAvailable: true
aliases:
  - GHSA-qgq7-7hm3-q39j
ecosystem: go
ingestedAt: '2026-08-07T17:15:34.157Z'
---

## Overview

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71557)

Affected packages:

- `github.com/go-git/go-git/v5 <= 5.19.1`
- `github.com/go-git/go-git/v6 <= 6.0.0-alpha.4`

Patched in:

- `github.com/go-git/go-git/v5 5.19.2`
- `github.com/go-git/go-git/v6 6.0.0-alpha.5`

Source: https://github.com/advisories/GHSA-qgq7-7hm3-q39j

## Vendor advisories

- **RHSA-2026:68806** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68806)
- **RHSA-2026:66208** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66208)
- **RHSA-2026:68808** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68808)
- **RHSA-2026:68281** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68281)
- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Custom Metric Autoscaler operator for Red Hat Openshift, DPU kit for NVIDIA, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71557.json)