Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-07T17:17:10.150Z",
  "pubdate": "2026-08-07T17:17:10.150Z",
  "executiveSummary": "An arbitrary file read and write vulnerability exists in the go-git library affecting worktree operations such as checkout, status, and add. The vulnerability stems from the improper handling and resolution of symbolic links located within the working tree, allowing symlinks to escape the intended worktree boundary.\nWhen a victim clones or performs worktree operations on a maliciously crafted repository, the attacker can leverage crafted symbolic links to target files and directories residing outside the designated working directory. This grants unauthorized attackers the capability to read sensitive host files or overwrite arbitrary files on the system depending on the specific worktree operation executed.\nThe vulnerability impacts go-git prior to versions 5.19.2 and 6.0.0-alpha.5. Successful exploitation requires the user to interact with a malicious repository by initiating clone or worktree operations, with no prior authentication or elevated privileges required on the target host.",
  "technicalDetails": "The root cause of the vulnerability lies in the path resolution logic utilized by worktree operations within go-git, including checkout, status, and add. Specifically, the library resolves symbolic links encountered inside the working tree without enforcing confinement checks or bounding the resolution path to the root of the working directory.\nThe vulnerable component comprises the repository worktree handling subsystems responsible for filesystem interactions during file enumeration, staging, and extraction. Because path traversal boundaries are not strictly validated against symlink redirection, target paths pointing to absolute locations or utilizing relative traversal sequences escaping the worktree root are incorrectly followed.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious Git repository containing a specially crafted symbolic link within the repository's file structure. This symbolic link is designed to point outside the working tree, targeting sensitive system files or application directories. Second, the victim obtains and processes this repository using go-git by performing operations such as a checkout, status check, or file addition. Third, as go-git evaluates and resolves the paths associated with the worktree files, it traverses the attacker-controlled symbolic link without restriction. Finally, the operation reads from or writes to the external filesystem location pointed to by the symlink, resulting in unauthorized information disclosure or arbitrary file modification.\nThe vulnerability affects go-git versions prior to 5.19.2 and 6.0.0-alpha.5. Exploitation does not require network exposure, authentication, or special privileges beyond the execution of worktree routines by the local user processing the untrusted repository."
}