CVE-2026-45571

5.4 Moyenne

Publiée le 27/05/2026 à 17:16 · Modifiée le 17/06/2026 à 12:52 · Analysée par le NVD · Source : security-advisories@github.com

Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

Traduire en français

Produits concernés

go-git
Go-git project go-git

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-22

Références

https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories