GitHub Advisoryadvisory · Go

GHSA-v725-9546-7q7m go-git has an Argument Injection via the URL field

CRITICAL Published 2025-01-06 Modified 2025-01-06 Official page ↗
Aliases
CVE-2025-21613
Ecosystem
Go
Packages
gopkg.in/src-d/go-git.v4, github.com/go-git/go-git/v5
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-88
Reviewed
2025-01-06

Affected packages

• Go gopkg.in/src-d/go-git.v4: >= 4.0.0, <= 4.13.1 (no fix yet) • Go github.com/go-git/go-git/v5: < 5.13.0 → fixed in 5.13.0

Description

Impact An argument injection vulnerability was discovered in `go-git` versions prior to `v5.13`. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the `file` transport protocol is being used, as that is the only protocol that shells out to `git` binaries. Affected versions Users running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.13` in order to mitigate this vulnerability. Workarounds In cases where a bump to the latest version of `go-git` is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field. Credit Thanks to @vin01 for responsibly disclosing this vulnerability to us.

Related

Alias · CVE (1)

  • CVE-2025-21613 go-git is a highly extensible git implementation library written in pure Go. vulnerability

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References