Path Validation Issue in go-git Affecting File Integrity

CVE-2026-45571

What is CVE-2026-45571?

The go-git library, an extensible git implementation written in Go, has a path validation issue that allows crafted repository data to potentially compromise files outside the intended checkout target, including sensitive areas such as the .git directory. This weakness arises from go-git's failure to adhere to established validation checks that are present in upstream Git versions. The flaw has been addressed in the releases 5.19.1 and 6.0.0-alpha.4, ensuring enhanced security for users.

References