Description
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-git | go-git | < 5.19.2, >= 6.0.0-alpha.1, < 6.0.0-alpha.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-git-go-git | 5.19.2-1 | — |
| Debian 14 | golang-github-go-git-go-git-v6 | 6.0.0~alpha.5-1 | — |
| Debian 13 | golang-github-go-git-go-git | No fix yet | — |
| Debian 12 | golang-github-go-git-go-git | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-go-git-go-git +1 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | golang-github-go-git-go-git | No fix yet | — |
| Ubuntu Pro 24.04 LTS | golang-github-go-git-go-git | No fix yet | — |
| Ubuntu Pro 22.04 LTS | golang-github-go-git-go-git | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grype | 0.118.0-0.1.hum1 | RHSA-2026:60793 |
| Red Hat Hardened Images 1 | kube-state-metrics | 2.20.0-0.2.hum1 | RHSA-2026:66208 |
| Red Hat Hardened Images 1 | syft | 1.51.1-0.1.hum1 | RHSA-2026:60646 |
| Red Hat Hardened Images 1 | trivy | 0.73.0-0.1.hum1 | RHSA-2026:66421, RHSA-2026:50953 |
| Red Hat Edge Manager 1 | flightctl +2 | 1.1.4-1.el9em | RHSA-2026:68335, RHSA-2026:68334 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | alloy | 1.19.2-150700.15.29.1 | SUSE-SU-2026:4408-1 |
| SLES 15 SP7 | amazon-ssm-agent | 3.3.5226.0-150000.5.40.1 | SUSE-SU-2026:4082-1 |
| SLES 15 SP6 | amazon-ssm-agent | 3.3.5226.0-150000.5.40.1 | SUSE-SU-2026:4082-1 |
| SLES 15 SP5 | amazon-ssm-agent | 3.3.5226.0-150000.5.40.1 | SUSE-SU-2026:4082-1 |
| SLES 15 SP5 | terraform-provider-aws | 3.11.0-150200.6.24.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-azurerm | 2.32.0-150200.6.18.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-external | 2.0.0-150200.6.18.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-google | 3.43.0-150200.6.18.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-helm | 2.9.0-150200.6.29.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-kubernetes | 1.13.2-150200.6.18.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-local | 2.0.0-150200.6.25.1 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-null | 3.0.0-150200.6.24.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-random | 3.0.0-150200.6.21.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP5 | terraform-provider-tls | 3.0.0-150200.5.21.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | amazon-ssm-agent | 3.3.5226.0-150000.5.40.1 | SUSE-SU-2026:4082-1 |
| SLES 15 SP4 | terraform-provider-aws | 3.11.0-150200.6.24.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-azurerm | 2.32.0-150200.6.18.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-external | 2.0.0-150200.6.18.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-google | 3.43.0-150200.6.18.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-helm | 2.9.0-150200.6.29.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-kubernetes | 1.13.2-150200.6.18.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-local | 2.0.0-150200.6.25.1 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-null | 3.0.0-150200.6.24.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-random | 3.0.0-150200.6.21.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 15 SP4 | terraform-provider-tls | 3.0.0-150200.5.21.2 | SUSE-SU-2026:4628-1, SUSE-SU-2026:3916-1 |
| SLES 12 | amazon-ssm-agent | 3.3.5390.0-4.52.1 | SUSE-SU-2026:4286-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | alloy | 1.19.2-160000.1.1 | SUSE-SU-2026:24148-1 |
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
| SLES 16.0 | alloy | 1.19.2-160000.1.1 | SUSE-SU-2026:24148-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | alloy | 1.19.2-1.1 | openSUSE-SU-2026:11803-1 |
| openSUSE Tumbleweed | amazon-ssm-agent | 3.3.5226.0-1.1 | openSUSE-SU-2026:11694-1 |
| openSUSE Leap 16.0 | alloy | 1.19.2-160000.1.1 | openSUSE-SU-2026:22032-1 |
| openSUSE Leap 16.0 | amazon-ssm-agent | 3.3.5390.0-160000.1.1 | openSUSE-SU-2026:21884-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | openSUSE-SU-2026:21761-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-ssm-agent | 3.3.5226.0-1.amzn2023 | ALAS2023-2026-3149, ALAS2023-2026-3110 |
| Amazon Linux 2 | amazon-ssm-agent | 3.3.5226.0-1.amzn2 | ALAS2-2026-3963, ALAS2-2026-3933 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cri-o | No fix yet | — |
| Azure Linux 3 | packer | 1.9.5-20 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | act | 0.2.89-r5 | — |
| Wolfi rolling | argo-cd-3.2 +1 | 3.2.12-r19 | — |
| Wolfi rolling | argo-cd-3.3 +1 | 3.3.14-r1 | — |
| Wolfi rolling | argo-cd-3.4 +1 | 3.4.7-r1 | — |
| Wolfi rolling | argo-events | 1.9.11-r2 | — |
| Wolfi rolling | argo-workflows-3.7 +1 | 3.7.17-r2 | — |
| Wolfi rolling | argo-workflows-4.0 +1 | 4.0.8-r3 | — |
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.11-r0 | — |
| Wolfi rolling | argocd-image-updater | 1.2.2-r7 | — |
| Wolfi rolling | bom | 0.7.1-r24 | — |
| Wolfi rolling | boring-registry | 0.19.0-r1 | — |
| Wolfi rolling | cerbos +1 | 0.54.0-r2 | — |
| Wolfi rolling | crossplane-2.2-crank | 2.2.4-r3 | — |
| Wolfi rolling | dagger | 0.20.8-r15 | — |
| Wolfi rolling | external-secrets-operator-2.3 | 2.3.0-r18 | — |
| Wolfi rolling | external-secrets-operator-2.4 | 2.4.1-r16 | — |
| Wolfi rolling | external-secrets-operator-2.5 | 2.5.0-r13 | — |
| Wolfi rolling | external-secrets-operator-2.6 | 2.6.0-r9 | — |
| Wolfi rolling | flux-2.7 | 2.7.5-r31 | — |
| Wolfi rolling | flux-2.8 | 2.8.8-r15 | — |
| Wolfi rolling | flux-2.9 | 2.9.4-r1 | — |
| Wolfi rolling | flux-image-automation-controller | 1.2.4-r1 | — |
| Wolfi rolling | flux-notification-controller | 1.9.3-r1 | — |
| Wolfi rolling | flux-source-controller | 1.9.4-r0 | — |
| Wolfi rolling | gitaly-19.0 | 19.0.5-r1 | — |
| Wolfi rolling | gitaly-19.1 | 19.1.3-r2 | — |
| Wolfi rolling | gitaly-compat-19.1 | 19.1.8-r0 | — |
| Wolfi rolling | gitea | 1.27.1-r1 | — |
| Wolfi rolling | gitlab-runner-18.11 +1 | No fix yet | — |
| Wolfi rolling | gitlab-runner-19.0 +1 | 19.0.3-r1 | — |
| Wolfi rolling | gitlab-runner-19.1 +1 | 19.1.2-r2 | — |
| Wolfi rolling | gitlab-runner-19.2 +1 | 19.2.1-r1 | — |
| Wolfi rolling | gitsign | 0.17.1-r1 | — |
| Wolfi rolling | gomplate-5 | 5.2.0-r2 | — |
| Wolfi rolling | goreleaser | 2.17.1-r2 | — |
| Wolfi rolling | gptscript | 0.9.9-r441 | — |
| Wolfi rolling | grafana-alloy | 1.18.0-r5 | — |
| Wolfi rolling | grype | 0.116.1-r1 | — |
| Wolfi rolling | guac +2 | 1.1.0-r25 | — |
| Wolfi rolling | k9s | 0.51.0-r9 | — |
| Wolfi rolling | kaniko | 1.25.17-r1 | — |
| Wolfi rolling | kargo-1.10 | 1.10.9-r3 | — |
| Wolfi rolling | kots | 1.131.1-r2 | — |
| Wolfi rolling | kubescape | 4.0.11-r5 | — |
| Wolfi rolling | kubevela-vela-cli +1 | 1.11.0-r4 | — |
| Wolfi rolling | kyverno-1.17 | 1.17.2-r35 | — |
| Wolfi rolling | kyverno-cli-1.17 | 1.17.2-r27 | — |
| Wolfi rolling | kyverno-cli-1.18 | 1.18.2-r6 | — |
| Wolfi rolling | kyverno-init-container-1.18 | 1.18.2-r15 | — |
| Wolfi rolling | nfpm | 2.47.0-r4 | — |
| Wolfi rolling | nuclei | 3.11.1-r1 | — |
| Wolfi rolling | pulumi +3 | 3.256.0-r2 | — |
| Wolfi rolling | pulumi-kubernetes-operator | 2.9.0-r1 | — |
| Wolfi rolling | pulumi-language-dotnet | 3.110.0-r1 | — |
| Wolfi rolling | pulumi-language-java | 1.35.0-r1 | — |
| Wolfi rolling | pulumi-language-yaml | 1.38.1-r1 | — |
| Wolfi rolling | rancher-fleet | 0.16.1-r3 | — |
| Wolfi rolling | rancher-fleet-cli +2 | 0.16.0-r1 | — |
| Wolfi rolling | scorecard | 5.5.0-r14 | — |
| Wolfi rolling | skaffold | 2.24.0-r2 | — |
| Wolfi rolling | snyk-cli | 1.1306.3-r1 | — |
| Wolfi rolling | src-fingerprint | 0.19.0-r56 | — |
| Wolfi rolling | steampipe | 2.4.4-r12 | — |
| Wolfi rolling | syft | 1.50.0-r1 | — |
| Wolfi rolling | tfsec | 1.28.14-r43 | — |
| Wolfi rolling | trivy | 0.73.0-r1 | — |
| Wolfi rolling | trivy-operator | 0.32.0-r2 | — |
| Wolfi rolling | trufflehog | 3.96.0-r1 | — |
| Wolfi rolling | witness | 0.12.0-r3 | — |
| Wolfi rolling | xeol | 0.10.8-r51 | — |
| Wolfi rolling | zot | 2.1.20-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-git/go-git/v5 | < 5.19.2 | 5.19.2 | GHSA-hc8v-wwc9-vgxm |
| Go | github.com/go-git/go-git/v6 | < 6.0.0-alpha.5 | 6.0.0-alpha.5 | GHSA-hc8v-wwc9-vgxm |
Advisories 24
- WID-SEC-2026-4175 Red Hat OpenShift GitOps (go-git): Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:68335 Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68334 Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:66421 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:66208 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:60793 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:60646 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50953 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2026:24148-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 16, 2026
- SUSE-SU-2026:4628-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls SUSE / openSUSE Security Updates · Oct 13, 2026
- openSUSE-SU-2026:22032-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 9, 2026
- SUSE-SU-2026:4408-1 Security update for alloy SUSE / openSUSE Security Updates · Oct 1, 2026
- ALAS2-2026-3963 Critical: amazon-ssm-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 30, 2026
- ALAS2023-2026-3149 Critical: amazon-ssm-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 30, 2026
- SUSE-SU-2026:23625-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- ALAS2023-2026-3110 Important: amazon-ssm-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- ALAS2-2026-3933 Important: amazon-ssm-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- openSUSE-SU-2026:21884-1 Security update for amazon-ssm-agent SUSE / openSUSE Security Updates · Sep 25, 2026
- SUSE-SU-2026:4286-1 Security update for amazon-ssm-agent SUSE / openSUSE Security Updates · Sep 23, 2026
- openSUSE-SU-2026:11803-1 alloy-1.19.2-1.1 on GA media SUSE / openSUSE Security Updates · Sep 18, 2026
- SUSE-SU-2026:4082-1 Security update for amazon-ssm-agent SUSE / openSUSE Security Updates · Sep 13, 2026
- SUSE-SU-2026:3916-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls SUSE / openSUSE Security Updates · Sep 10, 2026
- openSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 9, 2026
- openSUSE-SU-2026:11694-1 amazon-ssm-agent-3.3.5226.0-1.1 on GA media SUSE / openSUSE Security Updates · Sep 8, 2026
References
- https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm
- https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab
- https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac
- https://github.com/go-git/go-git/releases/tag/v5.19.2
- https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5