---
id: CVE-2026-71557
title: go-git is an extensible git implementation library written in pure Go
summary: >-
  go-git is an extensible git implementation library written in pure Go. Prior
  to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being
  used to construct on-disk paths under the reference storage directory, so a
  maliciou…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L'
cwe:
  - CWE-22
vendor: go-git
product: github.com/go-git/go-git/v5
affected:
  - github.com/go-git/go-git/v5 <= 5.19.1
  - github.com/go-git/go-git/v6 <= 6.0.0-alpha.4
patched:
  - github.com/go-git/go-git/v5 5.19.2
  - github.com/go-git/go-git/v6 6.0.0-alpha.5
published: '2026-08-07'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:41:33.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71557'
references:
  - url: >-
      https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7
    label: security-advisories@github.com
  - url: >-
      https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/pull/2247'
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/pull/2254'
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/releases/tag/v5.19.2'
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5'
    label: security-advisories@github.com
  - url: 'https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qgq7-7hm3-q39j'
tags:
  - nvd
  - exploit-available
  - ghsa
  - go
epss: 0.0046
epssPercentile: 0.37202
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Saku0512/CVE-2026-71557-poc'
  checkedAt: '2026-09-26T09:05:58.008Z'
exploitAvailable: true
aliases:
  - GHSA-qgq7-7hm3-q39j
ecosystem: go
ingestedAt: '2026-08-07T17:15:34.157Z'
---

## Overview

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71557)

Affected packages:

- `github.com/go-git/go-git/v5 <= 5.19.1`
- `github.com/go-git/go-git/v6 <= 6.0.0-alpha.4`

Patched in:

- `github.com/go-git/go-git/v5 5.19.2`
- `github.com/go-git/go-git/v6 6.0.0-alpha.5`

Source: https://github.com/advisories/GHSA-qgq7-7hm3-q39j