VYPR
← All advisories
Medium severity5.4GHSA Advisory· Published May 27, 2026· Updated Jun 4, 2026

CVE-2026-45571

CVE-2026-45571

Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/go-git/go-git/v5Go
< 5.19.15.19.1
github.com/go-git/go-git/v6Go
< 6.0.0-alpha.46.0.0-alpha.4
github.com/go-git/go-gitGo
<= 44.7.0—

Affected products

295

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.