write-ups

报告 GitHub Desktop v2.9.4 中的远程代码执行漏洞 通过 gh run download 实现远程代码执行 GitHub CLI Claude Code: 通过 .git 工作树混淆从提示注入实现非沙箱代码执行 — CVE-2026-55607...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

checkout-index

checkout-index - CVE-2025-22620の再現コード これは RUSTSEC-2025-0001 CVE-2025-22620、GHSA-fqmf-w4xh-33rh の概念実証コードです。勧告と同じコードですが、Rustプロジェクトの形式で、Cargo.toml と Cargo.lock が含まれています。 このリポジトリは勧告の執筆中に役立ちましたが、たまに他の人にも役立つかもしれないと思いました。ただし、これは勧告よりもはるかに興味が持たれないでしょう。また、これは勧告の情報の代わりになるものではありません。勧告に記載されているように、脆弱性は...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

Linux Distros Unpatched Vulnerability : CVE-2026-82248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82248

gix-worktree-state before 0.33.0 (part of gitoxide ) is vulnerable to path traversal via symlink following on Windows. During non-exclusive (incremental) materialization with core.symlinks=true, if a symlink entry is first checked out at a path pointing outside the worktree, a subsequent checkout...

EUVD-2026-67700

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82248 gitoxide before 0.33.0 Path Traversal via symlink following

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82248 gitoxide before 0.33.0 Path Traversal via symlink following

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

PT-2026-83100

Name of the Vulnerable Software and Affected Versions gix-worktree-state versions prior to 0.33.0 Description On Windows, the software allows writing files outside the worktree. This occurs when the gix worktree state::checkout function follows an existing terminal symlink during non-exclusive...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

GO-2026-6213 Worktree operations may follow symlinks in github.com/go-git/go-git

Worktree operations may follow symlinks in github.com/go-git/go-git...

CVE-2026-71556

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

go-git: Worktree operations may follow symlinks

...

AZL-95484 CVE-2026-71556 affecting package packer for versions less than 1.9.5-20

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...