CVE-2026-71556
go-git: Worktree operations may follow symlinks
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
| CWE | CWE-59 |
| Vendor | go-git |
| Product | go-git |
| Published | Aug 7, 2026 |
| Last Updated | Aug 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-git go-git
Be the first to know when new high vulnerabilities affecting go-git go-git are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
go-git / go-git
< 5.19.2 >= 6.0.0-alpha.1, < 6.0.0-alpha.5
References
github.com: https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm github.com: https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab github.com: https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac github.com: https://github.com/go-git/go-git/releases/tag/v5.19.2 github.com: https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5