CyberRota Analysis
AI-GeneratedThe go-git library is vulnerable due to improper sanitization of reference names, allowing attackers to exploit directory traversal sequences to write files outside the designated storage directory. This could lead to unauthorized file access or overwriting critical files on the system. Developers and organizations utilizing go-git versions prior to 5.19.2 and 6.0.0-alpha.5 should prioritize upgrading to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.