go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
go-git:go-git
References 5
https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm
https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm
https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab
https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab
https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac
https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac
https://github.com/go-git/go-git/releases/tag/v5.19.2
https://github.com/go-git/go-git/releases/tag/v5.19.2
https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5
https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5