CVE-2025-21613

Name of the Vulnerable Software and Affected Versions go-git versions prior to v5.13

Description An argument injection vulnerability was discovered in go-git. The successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries.

Recommendations For go-git versions prior to v5.13, upgrade to version 5.13.0 to mitigate this vulnerability. As a temporary workaround, consider enforcing strict validation rules for values passed in the URL field. Restrict access to the file transport protocol to minimize the risk of exploitation. Avoid using the file transport protocol until the issue is resolved.