Product by Go
Github.com/go-git/go-git/v5
13 known vulnerabilities in Github.com/go-git/go-git/v5 (Go), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-49569 | Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients | 9.8 | |
| Critical | CVE-2025-21613 | go-git has an Argument Injection via the URL field | 9.8 | |
| Critical | CVE-2026-45570 | go-git: Improper single-quote escaping in go-git SSH transport | 9.6 | |
| High | CVE-2026-71556 | go-git: Worktree operations may follow symlinks | 7.1 | |
| High | CVE-2025-21614 | go-git clients vulnerable to DoS via maliciously crafted Git server replies | 7.5 | |
| Medium | CVE-2026-71557 | go-git: Malicious reference names may modify files outside the reference storage | 6.3 | |
| High | CVE-2023-49568 | Maliciously crafted Git server replies can cause DoS on go-git clients | 7.5 | |
| High | CVE-2026-45022 | Go-git: Incorrect Behavior Order: Validate Before Canonicalize | 7.5 | |
| Medium | CVE-2026-45571 | go-git: Crafted repositories may modify main and submodule .git directories | 5.4 | |
| High | CVE-2026-41506 | go-git Credential leak via cross-host redirect in smart HTTP transport | 4.7 | |
| Medium | CVE-2026-34165 | go-git: Maliciously crafted idx file can cause asymmetric memory consumption | 5.0 | |
| Medium | CVE-2026-25934 | go-git improperly verifies data integrity values for .idx and .pack files | 4.3 | |
| Low | CVE-2026-33762 | go-git: Missing validation decoding Index v4 files leads to panic | 2.8 |