VulnSocial

CVE-2026-45571Patch(go-git_project / go-git)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

go-git_project CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • go-git

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Patch: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-05-23); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
go-git_project
Products
go-git

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-23: 1Mentions · 2026-06-29: 1Technical Details · 2026-05-23: 1Technical Details · 2026-06-29: 105-2306-29
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-05-231
Patch1
2026-06-291
Disclosure1
Full discourse2 posts
  • connect24h@connect24h
    Disclosure

    go-gitを「ただのclone部品」と見ている組織、ここは棚卸し案件だと思う。CVE-2026-45571はcrafted repositoryでmain/submoduleの.git directoryを変更し得る話、CVE-2026-45570はSSH transportのsingle-quote escaping不備。 Git処理系の穴がCI/CD runner、依存取得、社内コード解析基盤へ直結する点。今日見るべきはgo-git利用サービス、untrusted repo/submoduleのclone有無、.git/config・hooks・alternatesの差分監視ね。 #セキュリティ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45571

    Post summary

    The tweet highlights two CVEs affecting go‑git that could alter repository metadata and impact CI/CD pipelines, but it does not mention active exploitation, patches, or a proof‑of‑concept.

    00000349
    4.1K followersView on X
  • Stanislav Klevtsov@stansecure
    Patch

    Join my Teleram: https://t.me/securediary 📌 Patch these #CVE: - @Microsoft Defender #PrivEsc (CVE-2026-41091) - #DoS flaw in #Exchange Server (CVE-2026-42897) - @Cisco SD-WAN auth bypass (CVE-2026-20182) - @Linux kernel 9-year-old flaw, reads SSH keys and shadow file (CVE-2026-4633) - @PaloAltoNtwks PAN-OS urgent vuln (CVE-2026-0300) - @nginx #RCE (CVE-2026-42945) - @Drupal Core worker crashes and possible #RCE (PSA-2026-05-18) - #Ivanti EPMM #RCE (CVE-2026-6973) - @gitlab path validation issue (CVE-2026-45571) - @PostgreSQL (CVE-2026-6472 and others) - @valkey_io (CVE-2026-23479)

    Post summary

    The message lists a set of newly disclosed CVEs across several vendors and urges users to apply patches, but it does not provide technical details about exploitation mechanisms or confirm active attacks.

    00000271
    42 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appgo-git_projectgo-git-go-
Appgo-git_projectgo-git6.0.0go-
Appgo-git_projectgo-git6.0.0go-
Appgo-git_projectgo-git6.0.0go-

Explore more

Back to dashboardgo-git_project CVEsgo-git vulnerabilities