Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-45571 EUVD-2026-32544GHSA-crhj-59gh-8x96GO-2026-5336

go-git: Crafted repositories may modify main and submodule .git directories

Published May 27, 2026 · Updated May 27, 2026 · Assigned by GitHub_M

Vendor: go-git Product: go-git Package: act Package: apko Package: argo-cd-3.2 Package: argo-cd-3.2-compat Package: argo-cd-3.3-compat Package: argo-cd-3.4 Package: argo-cd-3.4-compat Package: argo-events Package: argo-workflow-executor-3.7 Package: argo-workflow-executor-4.0 Package: argo-workflows-3.7 Package: argo-workflows-4.0 Package: argocd-image-updater Package: bom Package: cerbos Package: cerbosctl Package: cri-o Package: crossplane-2.2-crank Package: dagger Package: external-secrets-operator-1.1 Package: external-secrets-operator-2.3 Package: external-secrets-operator-2.4 Package: external-secrets-operator-2.5 Package: flux-2.7 Package: flux-2.8 Package: flux-image-automation-controller Package: gitaly-18.10 Package: gitaly-18.11 Package: gitaly-18.6 Package: gitaly-18.7 Package: gitaly-18.8 Package: gitaly-18.9 Package: gitea Package: github.com/go-git/go-git Package: github.com/go-git/go-git/v5 Package: github.com/go-git/go-git/v6 Package: gitlab-runner-18.10 Package: gitlab-runner-18.11 Package: gitlab-runner-18.6 Package: gitlab-runner-18.7 Package: gitlab-runner-18.8 Package: gitlab-runner-18.9 Package: gitlab-runner-helper-18.10 Package: gitlab-runner-helper-18.11 Package: gitlab-runner-helper-18.6 Package: gitlab-runner-helper-18.7 Package: gitlab-runner-helper-18.8 Package: gitlab-runner-helper-18.9 Package: gitsign Package: golang-github-go-git-go-git Package: golang-github-go-git-go-git Package: golang-github-go-git-go-git-v6 Package: gomplate-5 Package: goreleaser Package: gptscript Package: grafana-alloy Package: grype Package: guac Package: guacingest Package: guacone Package: k9s Package: kaniko Package: kargo Package: kots Package: kubescape Package: kubevela-vela-cli Package: kubevela-vela-core Package: kyverno-1.17 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: melange Package: nfpm Package: nuclei Package: osv-scanner Package: packer Package: pulumi Package: pulumi-kubernetes-operator Package: pulumi-language-dotnet Package: pulumi-language-go Package: pulumi-language-java Package: pulumi-language-nodejs Package: pulumi-language-python Package: pulumi-language-yaml Package: rancher-fleet-cli Package: rancher-fleet-controller Package: scorecard Package: skaffold Package: snyk-cli Package: src-fingerprint Package: steampipe Package: syft Package: teleport-18.6 Package: terragrunt Package: tfsec Package: trivy Package: trivy-operator Package: trufflehog Package: witness Package: wolfictl Package: xeol Package: zarf Package: zot Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

Affected products

VendorProductAffectedFixed
go-git go-git < 5.19.1, >= 6.0.0-alpha.1, < 6.0.0-alpha.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-github-go-git-go-git 5.19.1-1 —
Debian 14 golang-github-go-git-go-git-v6 6.0.0~alpha4-1 —
Debian 13 golang-github-go-git-go-git No fix yet —
Debian 12 golang-github-go-git-go-git No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-go-git-go-git No fix yet —
Ubuntu 25.10 golang-github-go-git-go-git No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS golang-github-go-git-go-git No fix yet —
Ubuntu Pro 24.04 LTS golang-github-go-git-go-git No fix yet —
Ubuntu Pro 22.04 LTS golang-github-go-git-go-git No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1
SLES 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed flux2-cli 2.8.8-1.1 openSUSE-SU-2026:10831-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 openSUSE-SU-2026:21551-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cri-o No fix yet —
Azure Linux 3 packer 1.9.5-17 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling act 0.2.88-r4 —
Wolfi rolling apko 1.2.13-r1 —
Wolfi rolling argo-cd-3.2 +1 3.2.12-r1 —
Wolfi rolling argo-cd-3.3-compat 3.3.10-r3 —
Wolfi rolling argo-cd-3.4 +1 3.4.2-r2 —
Wolfi rolling argo-events 1.9.10-r22 —
Wolfi rolling argo-workflows-3.7 +1 3.7.14-r4 —
Wolfi rolling argo-workflows-4.0 +1 4.0.5-r5 —
Wolfi rolling argocd-image-updater 1.2.1-r1 —
Wolfi rolling bom 0.7.1-r20 —
Wolfi rolling cerbos +1 0.53.0-r4 —
Wolfi rolling crossplane-2.2-crank 2.2.1-r3 —
Wolfi rolling dagger 0.20.8-r6 —
Wolfi rolling external-secrets-operator-2.3 2.3.0-r8 —
Wolfi rolling external-secrets-operator-2.4 2.4.1-r5 —
Wolfi rolling external-secrets-operator-2.5 2.5.0-r1 —
Wolfi rolling flux-2.7 2.7.5-r18 —
Wolfi rolling flux-2.8 2.8.8-r0 —
Wolfi rolling flux-image-automation-controller 1.1.4-r0 —
Wolfi rolling gitaly-18.10 18.10.6-r3 —
Wolfi rolling gitaly-18.11 18.11.4-r1 —
Wolfi rolling gitaly-18.6 +9 No fix yet —
Wolfi rolling gitaly-18.9 18.9.7-r3 —
Wolfi rolling gitea 1.26.2-r0 —
Wolfi rolling gitlab-runner-18.10 +1 18.10.1-r9 —
Wolfi rolling gitlab-runner-18.11 +1 18.11.3-r2 —
Wolfi rolling gitlab-runner-18.9 +1 18.9.0-r13 —
Wolfi rolling gitsign 0.16.0-r4 —
Wolfi rolling gomplate-5 5.1.0-r4 —
Wolfi rolling goreleaser 2.15.4-r5 —
Wolfi rolling gptscript 0.9.9-r145 —
Wolfi rolling grafana-alloy 1.16.1-r1 —
Wolfi rolling grype 0.112.0-r3 —
Wolfi rolling guac +2 1.1.0-r16 —
Wolfi rolling k9s 0.50.18-r25 —
Wolfi rolling kaniko 1.25.15-r1 —
Wolfi rolling kargo 1.10.4-r1 —
Wolfi rolling kots 1.130.4-r2 —
Wolfi rolling kubescape 4.0.8-r4 —
Wolfi rolling kubevela-vela-cli +1 1.10.8-r7 —
Wolfi rolling kyverno-1.17 1.17.2-r35 —
Wolfi rolling kyverno-cli-1.17 1.17.2-r6 —
Wolfi rolling kyverno-cli-1.18 1.18.1-r1 —
Wolfi rolling melange 0.50.7-r1 —
Wolfi rolling nfpm 2.46.3-r3 —
Wolfi rolling nuclei 3.8.0-r7 —
Wolfi rolling osv-scanner 2.3.8-r2 —
Wolfi rolling pulumi +3 3.243.0-r0 —
Wolfi rolling pulumi-kubernetes-operator 2.7.0-r6 —
Wolfi rolling pulumi-language-dotnet 3.106.2-r2 —
Wolfi rolling pulumi-language-java 1.28.0-r1 —
Wolfi rolling pulumi-language-yaml 1.34.0-r2 —
Wolfi rolling rancher-fleet-cli +1 0.15.2-r0 —
Wolfi rolling scorecard 5.5.0-r5 —
Wolfi rolling skaffold 2.20.0-r1 —
Wolfi rolling snyk-cli 1.1304.3-r3 —
Wolfi rolling src-fingerprint 0.19.0-r51 —
Wolfi rolling steampipe 2.4.3-r1 —
Wolfi rolling syft 1.44.0-r4 —
Wolfi rolling teleport-18.6 18.6.8-r20 —
Wolfi rolling terragrunt 1.1.0-r0 —
Wolfi rolling tfsec 1.28.14-r34 —
Wolfi rolling trivy 0.70.0-r0 —
Wolfi rolling trivy-operator 0.30.1-r10 —
Wolfi rolling trufflehog 3.94.3-r8 —
Wolfi rolling witness 0.11.0-r4 —
Wolfi rolling wolfictl 0.39.16-r1 —
Wolfi rolling xeol 0.10.8-r40 —
Wolfi rolling zarf 0.76.0-r1 —
Wolfi rolling zot 2.1.17-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/go-git/go-git <= 44.7.0 — GHSA-crhj-59gh-8x96
Go github.com/go-git/go-git/v5 < 5.19.1 5.19.1 GHSA-crhj-59gh-8x96
Go github.com/go-git/go-git/v6 < 6.0.0-alpha.4 6.0.0-alpha.4 GHSA-crhj-59gh-8x96

Advisories 4

References