Skip to content

fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security]#37786

Merged
lunny merged 1 commit into
mainfrom
renovate/go-github.1485827954.workers.dev-go-git-go-git-v5-vulnerability
May 19, 2026
Merged

fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security]#37786
lunny merged 1 commit into
mainfrom
renovate/go-github.1485827954.workers.dev-go-git-go-git-v5-vulnerability

Conversation

@GiteaBot
Copy link
Copy Markdown
Collaborator

@GiteaBot GiteaBot commented May 19, 2026

This PR contains the following updates:

Package Change Age Confidence
github.com/go-git/go-git/v5 v5.19.0 → v5.19.1 age confidence

go-git: Crafted repositories may modify main and submodule .git directories

CVE-2026-45571 / GHSA-crhj-59gh-8x96

More information

Details

Impact

A path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory.

These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. Some attack vectors were platform-specific: certain payloads affected only Windows users, others affected only macOS users, and some applied across all supported platforms.

Using non-descendant go-billy filesystem instances, or different filesystem types, for the Storer and Worktree may provide some isolation against .git directory manipulation. For example, users that store the .git directory through memfs while using osfs for the worktree are not affected by this vulnerability in the main repository, because repository metadata is not materialized inside the worktree filesystem.

However, this isolation does not necessarily apply when the repository contains submodules, since submodule dotgit directories may still be represented or materialized within the worktree context.

It is important to note that exploitation requires a maliciously crafted repository payload. Users should always exercise caution when interacting with repositories or Git servers they do not trust.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credits

Thanks to @​kodareef5, @​AyushParkara and @​N0zoM1z0 for reporting this to the go-git project in three separate reports. 🙇

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

go-git: Improper single-quote escaping in go-git SSH transport

CVE-2026-45570 / GHSA-m7cr-m3pv-hgrp

More information

Details

Impact

go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. This diverges from canonical Git, which shell-quotes the path through sq_quote_buf so that an embedded ' becomes the '\'' close-escape-reopen sequence and the whole path round-trips as a single quoted argument.

A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. On SSH servers that evaluate the exec command through a shell (for example a user account whose login shell is /bin/sh or /bin/bash, or a ForceCommand wrapper that re-evaluates $SSH_ORIGINAL_COMMAND), those additional tokens execute in that account's command-execution context. SSH servers that tokenize the exec command without shell evaluation, including the canonical git-shell setup, are not affected.

The vulnerable behaviour is on the SSH server side, not in go-git: the same bytes can be produced by any SSH client. The change in go-git is defense-in-depth that restores parity with canonical Git's wire format and prevents go-git from being a vehicle for reaching shell-evaluating servers through attacker-influenced repository paths.

Patches

Users should upgrade to a patched version in order to mitigate this issue. The fix ports sq_quote_buf from canonical Git into go-git's SSH transport so that the wire output is byte-identical to what git itself would send for the same input.

Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credit

Thanks to @​N0zoM1z0 for reporting this to the go-git project. 🙇

Severity

  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

go-git/go-git (github.com/go-git/go-git/v5)

v5.19.1

Compare Source

What's Changed

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@GiteaBot GiteaBot added dependencies lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 19, 2026
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 19, 2026
@GiteaBot GiteaBot force-pushed the renovate/go-github.1485827954.workers.dev-go-git-go-git-v5-vulnerability branch from fd0243b to 5e7dd8d Compare May 19, 2026 18:15
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 19, 2026
@lunny lunny enabled auto-merge (squash) May 19, 2026 18:26
@bircni bircni added reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! labels May 19, 2026
@lunny lunny merged commit 42e167b into main May 19, 2026
34 of 35 checks passed
@lunny lunny deleted the renovate/go-github.1485827954.workers.dev-go-git-go-git-v5-vulnerability branch May 19, 2026 21:03
@GiteaBot GiteaBot added this to the 1.27.0 milestone May 19, 2026
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label May 19, 2026
silverwind added a commit to silverwind/gitea that referenced this pull request May 19, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into ci-rustfs
c6598d9 
* origin/main: (104 commits)
  fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (go-gitea#37786)
  fix(pull): handle empty pull request files view to allow reviews (go-gitea#37783)
  fix(markup): make RenderString never fail (go-gitea#37779)
  fix(markup): wrap indented code blocks for the code-copy button (go-gitea#37748)
  fix(permissions): Fix reading permission (go-gitea#37769)
  fix: add natural sort to sortTreeViewNodes (go-gitea#37772)
  fix: package creation unique conflict (go-gitea#37774)
  fix(deps): update npm dependencies (go-gitea#37768)
  fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (go-gitea#37771)
  ci: split giteabot workflow (go-gitea#37770)
  [skip ci] Updated translations via Crowdin
  fix: Unify public-only token filtering in API queries and repo access checks (go-gitea#37118)
  fix(deps): update module google.golang.org/grpc to v1.81.1 (go-gitea#37762)
  chore: make DefaultTitleSource default to auto to match GitHub (go-gitea#37767)
  ci: fix cache-related issues (go-gitea#37761)
  chore: fix tests (go-gitea#37760)
  refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (go-gitea#37764)
  fix(deps): update go dependencies (go-gitea#37752)
  chore(deps): update action dependencies (go-gitea#37751)
  fix(deps): update module github.com/google/go-github/v85 to v86 (go-gitea#37754)
  ...

# Conflicts:
#	.github/workflows/pull-db-tests.yml
#	modules/storage/s3_test.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lunny lunny lunny approved these changes

@TheFox0x7 TheFox0x7 TheFox0x7 approved these changes

Assignees

No one assigned

Labels

dependencies lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. topic/security Something leaks user information or is otherwise vulnerable. Should be fixed!

Projects

None yet

Milestone

1.27.0

Development

Successfully merging this pull request may close these issues.

4 participants

@GiteaBot @lunny @TheFox0x7 @bircni