CVE-2026-71556highCWE-59

CVE-2026-71556: high-severity vulnerability in go-git

go-git: Worktree operations may follow symlinks

Published

Follow this CVE+ Monitor go-git+ Monitor golang-github-go-git-go-git

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Affected products
go-git · go-git
Related CVEs — go-git

In the same product, most dangerous first.

CVE-2023-49569CRITICALMaliciously crafted Git server replies can lead to path traversal and RCE on go-git clientsEPSS 1.5%CVE-2025-21613CRITICALgo-git has an Argument Injection via the URL fieldEPSS 1.3%CVE-2025-21614HIGHgo-git clients vulnerable to DoS via maliciously crafted Git server repliesEPSS 0.7%CVE-2023-49568HIGHMaliciously crafted Git server replies can cause DoS on go-git clientsEPSS 0.7%CVE-2026-71557MEDIUMgo-git: Malicious reference names may modify files outside the reference storageEPSS 0.4%CVE-2026-45570LOWgo-git: Improper single-quote escaping in go-git SSH transportEPSS 0.4%