{"id":"CVE-2026-71557","title":"go-git is an extensible git implementation library written in pure Go","summary":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciou…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","cwe":["CWE-22"],"vendor":"go-git","product":"github.com/go-git/go-git/v5","affected":["github.com/go-git/go-git/v5 <= 5.19.1","github.com/go-git/go-git/v6 <= 6.0.0-alpha.4"],"patched":["github.com/go-git/go-git/v5 5.19.2","github.com/go-git/go-git/v6 6.0.0-alpha.5"],"published":"2026-08-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:41:33.140","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71557","references":[{"url":"https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/pull/2247","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/pull/2254","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/releases/tag/v5.19.2","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","label":"security-advisories@github.com"},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-qgq7-7hm3-q39j"}],"tags":["nvd","exploit-available","ghsa","go"],"epss":0.0046,"epssPercentile":0.37112,"exploits":{"github":1,"githubRepos":["https://github.com/Saku0512/CVE-2026-71557-poc"],"checkedAt":"2026-09-25T08:21:10.673Z"},"exploitAvailable":true,"aliases":["GHSA-qgq7-7hm3-q39j"],"ecosystem":"go","ingestedAt":"2026-08-07T17:15:34.157Z","slug":"CVE-2026-71557","body":"## Overview\n\ngo-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71557)\n\nAffected packages:\n\n- `github.com/go-git/go-git/v5 <= 5.19.1`\n- `github.com/go-git/go-git/v6 <= 6.0.0-alpha.4`\n\nPatched in:\n\n- `github.com/go-git/go-git/v5 5.19.2`\n- `github.com/go-git/go-git/v6 6.0.0-alpha.5`\n\nSource: https://github.com/advisories/GHSA-qgq7-7hm3-q39j","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5463,"id":"CVE-2026-71557","ts":1788887284690,"field":"exploit_available","old":"false","new":"true"},{"seq":4346,"id":"CVE-2026-71557","ts":1788886398574,"field":"exploit_available","old":"true","new":"false"},{"seq":3072,"id":"CVE-2026-71557","ts":1788883061768,"field":"exploit_available","old":"false","new":"true"},{"seq":2101,"id":"CVE-2026-71557","ts":1788882466647,"field":"exploit_available","old":"true","new":"false"},{"seq":1167,"id":"CVE-2026-71557","ts":1788881903429,"field":"exploit_available","old":"false","new":"true"}]}