EUVD-2026-54527

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557

CVE-2026-71557 affects the go-git library (pure Go). The vulnerability occurs when reference names are not sanitized before being used to build on-disk paths under the reference storage directory, allowing malicious reference names (e.g., containing directory traversal sequences) to cause writes ...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

GHSA-HC8V-WWC9-VGXM go-git: Worktree operations may follow symlinks

Impact A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path. The worktreeFilesystem wrapper rejected dangerous path strings, including paths containing .git, parent-directory components, or control characters. However, it did not...

go-git: Worktree operations may follow symlinks

Impact A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path. The worktreeFilesystem wrapper rejected dangerous path strings, including paths containing .git, parent-directory components, or control characters. However, it did not...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

EUVD-2026-54526

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556 go-git: Worktree operations may follow symlinks

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556

CVE-2026-71556 affects the Go library go-git (Go) and involves worktree operations (checkout, status, add) not confining symlink resolution to the worktree boundary. A malicious repository containing a symlink can cause access to files outside the intended working directory when cloning and using...

CVE-2026-71556 go-git: Worktree operations may follow symlinks

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in worktreefs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in worktreefs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in worktreefs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-76220 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-76220 Source advisory: OSV:GHSA-WVPP-8HX9-P66J...