Go-git vulnerabilities
We track 9 vulnerabilities in Go-git products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on August 7, 2026.
Latest Go-git vulnerabilities
- 7.1 High severity
go-git: Improper Link Resolution Before File Access
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boun
- 8.1 High severity
go-billy: Improper Limitation of a Pathname to a Restricted Directory
Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intend
- 9.6 Critical severity
go-git: Improper Encoding or Escaping of Output
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside
- 7.5 High severity
go-git: Incorrect Behavior Order: Validate Before Canonicalize
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’
- 7.4 High severity
go-git: Insufficiently Protected Credentials
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patche
- 7.5 High severity
go-git: Uncontrolled Resource Consumption
go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing speci
- 9.2 Critical severity
go-git: Improper Neutralization of Argument Delimiters in a Command
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to
- 9.8 Critical severity
go-git: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only a
- 7.5 High severity
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11.
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion i