Go/github.com/go-git/go-git/v6 CVE-2026-71557: medium 6.3, EPSS 0.41%

Path traversal via crafted reference names in github.com/go-git/go-git

Action: Upgrade github.com/go-git/go-git/v6 to 6.0.0-alpha.5 or later.

go get github.com/go-git/go-git/v6@v6.0.0-alpha.5

Affected

Fixed versions

Sources

• osv: GO-2026-6214#Go/github.com/go-git/go-git/v6
• nvd: CVE-2026-71557
• https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j
• https://github.com/go-git/go-git/pull/2247
• https://github.com/go-git/go-git/pull/2254
• https://github.com/go-git/go-git/releases/tag/v5.19.2
• https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5

CVE-2026-71557 · published 2026-08-18T16:38:10Z · modified 2026-09-01T03:55:58.553700699Z · JSON