Symlink Vulnerability in go-git by The Go Programming Language
CVE-2026-71556
7.1HIGH
What is CVE-2026-71556?
The go-git library, a Git implementation written in Go, is susceptible to a vulnerability that affects worktree operations. Prior to version 5.19.2 and 6.0.0-alpha.5, this flaw enables malicious repositories containing symbolic links to manipulate file reading and writing operations outside the designated working directory. This behavior can lead to unauthorized access to sensitive files when users execute worktree actions such as checkout, status, or add. Updating to the latest versions is essential for maintaining security.
Affected Version(s)
go-git < 5.19.2 < 5.19.2
go-git >= 6.0.0-alpha.1, < 6.0.0-alpha.5 < 6.0.0-alpha.1, 6.0.0-alpha.5