CVE-2023-49569criticalCWE-22

CVE-2023-49569: falha crítica em go-git

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar go-git+ Monitorar golang-github-go-git-go-git

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.5%
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
go-git · go-git
CVEs relacionadas — go-git

No mesmo produto, das mais perigosas para as menos.

CVE-2025-21613CRITICALgo-git has an Argument Injection via the URL fieldEPSS 1.3%CVE-2025-21614HIGHgo-git clients vulnerable to DoS via maliciously crafted Git server repliesEPSS 0.7%CVE-2023-49568HIGHMaliciously crafted Git server replies can cause DoS on go-git clientsEPSS 0.7%CVE-2026-71557MEDIUMgo-git: Malicious reference names may modify files outside the reference storageEPSS 0.4%CVE-2026-45570LOWgo-git: Improper single-quote escaping in go-git SSH transportEPSS 0.4%CVE-2026-71556HIGHgo-git: Worktree operations may follow symlinksEPSS 0.4%