Go/github.com/go-git/go-git/v5 CVE-2026-71557: medium 6.3, EPSS 0.41%

go-git: Malicious reference names may modify files outside the reference storage

Action: Upgrade github.com/go-git/go-git/v5 to 5.19.2 or later.

go get github.com/go-git/go-git/v5@v5.19.2

Affected

Fixed versions

Sources

• osv: GHSA-qgq7-7hm3-q39j
• https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j
• https://github.com/go-git/go-git/pull/2247
• https://github.com/go-git/go-git/pull/2254
• https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7
• https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36
• https://github.com/go-git/go-git
• https://github.com/go-git/go-git/releases/tag/v5.19.2
• https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5

CVE-2026-71557 · published 2026-08-07T16:41:51Z · modified 2026-09-10T03:50:53.977014620Z · JSON