CVE-2026-71556

Name of the Vulnerable Software and Affected Versions go-git versions prior to 5.19.2 go-git versions prior to 6.0.0-alpha.5

Description Worktree operations, including checkout, status, and add, resolve symbolic links within the working tree without confining the resolution to the worktree boundary. This allows a maliciously crafted repository containing a symlink to cause the library to read from or write to files outside the intended working directory. The worktreeFilesystem wrapper previously rejected dangerous path strings but failed to prevent operations from following existing symbolic links. Consequently, a path that appears safe as a string can resolve to the repository's Git metadata directory or other external files. For instance, if a symbolic link s points to .git, writing to s/config modifies .git/config. Applications using storage/memory for their Storer or go-billy/memfs for their Worktree are not affected.

Recommendations Upgrade to version 5.19.2 or later. Upgrade to version 6.0.0-alpha.5 or later.