GO-2026-5336
- Source
- https://pkg.go.dev/vuln/GO-2026-5336
- Import Source
- https://vuln.go.dev/ID/GO-2026-5336.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-5336
- Aliases
- Downstream
- Related
- Published
- 2026-07-24T18:35:55Z
- Modified
- 2026-08-08T21:41:52Z
- Summary
- Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git
- Details
-
Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-5336" }- References
Affected packages
Go / github.com/go-git/go-git/v5
Package
- Name
- github.com/go-git/go-git/v5
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/go-git/go-git/v5
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed5.19.1
Ecosystem specific
{
"imports": [
{
"path": "github.com/go-git/go-git/v5",
"symbols": [
"Clone",
"CloneContext",
"PlainClone",
"PlainCloneContext",
"Submodule.Update",
"Submodule.UpdateContext",
"Submodules.Update",
"Submodules.UpdateContext",
"Worktree.Checkout",
"Worktree.Pull",
"Worktree.PullContext"
]
}
]
}