CVE-2026-71556

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71556
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71556.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71556
Aliases
Downstream
AZL (2)
CGA (522)
CLEANSTART (15)
DEBIAN (1)
ECHO (1)
MINI (244)
openSUSE (5)
RHSA (7)
ROOT (1)
SUSE (7)
UBUNTU (1)
Related
openSUSE (5)
SUSE (7)
Published
2026-08-07T16:37:40Z
Modified
2026-10-28T02:30:58Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L CVSS Calculator
Summary
go-git: Worktree operations may follow symlinks
Details

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-59"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71556.json"
}
References

Affected packages

Git / github.com/go-git/go-git

Affected ranges

Type
GIT
Repo
https://github.com/go-git/go-git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3eeb238da61eb9c7a324f3ee04f990ce89175642
Introduced
5c776e15a11be5d2dfc6df27692bf867a69c37d8
Fixed
fc18716c90bcd8e8c935742431e26e260ab7ef60
Fixed
008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab
Fixed
661d1c7f101d34e002a3cfcf8dbea5b7421d07ac
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.19.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "6.0.0-alpha.1"
                },
                {
                    "fixed":  "6.0.0-alpha.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v5.19.2",
            "range":  [
                {
                    "fixed":  "3eeb238da61eb9c7a324f3ee04f990ce89175642"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v6.0.0-alpha.5",
            "range":  [
                {
                    "fixed":  "fc18716c90bcd8e8c935742431e26e260ab7ef60"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.2.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.1.0
v3.1.1
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc10
v4.0.0-rc11
v4.0.0-rc12
v4.0.0-rc13
v4.0.0-rc14
v4.0.0-rc15
v4.0.0-rc2
v4.0.0-rc3
v4.0.0-rc4
v4.0.0-rc5
v4.0.0-rc6
v4.0.0-rc7
v4.0.0-rc8
v4.0.0-rc9
v4.1.0
v4.1.1
v4.10.0
v4.11.0
v4.12.0
v4.13.0
v4.13.1
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.5.0
v4.6.0
v4.7.0
v4.7.1
v4.8.0
v4.8.1
v4.9.0
v4.9.1
v5.*
v5.0.0
v5.1.0
v5.10.0
v5.10.1
v5.11.0
v5.12.0
v5.13.0
v5.13.1
v5.13.2
v5.14.0
v5.15.0
v5.16.0
v5.16.1
v5.16.2
v5.16.3
v5.16.4
v5.16.5
v5.17.0
v5.17.1
v5.17.2
v5.18.0
v5.19.0
v5.19.1
v5.2.0
v5.3.0
v5.4.0
v5.4.1
v5.4.2
v5.5.0
v5.5.1
v5.5.2
v5.6.0
v5.6.1
v5.7.0
v5.8.0
v5.8.1
v5.9.0
v6.*
v6.0.0-alpha.1
v6.0.0-alpha.2
v6.0.0-alpha.3
v6.0.0-alpha.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71556.json"