CRITICAL🇵🇱 Wersja polska

CVE-2025-21613

CVSS 9.2v4.0pub. 2025-01-06upd. 2025-04-17

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The vulnerability is revealed exclusively when using the file transport protocol, which is the only one that invokes external git binaries as subprocesses (shell out). An attacker can craft input in such a way as to pass arbitrary arguments or flags to the git-upload-pack call that are not expected by the library. Lack of proper argument sanitization before passing them to an external process leads to successful exploitation.

Impact

Successful exploitation of the vulnerability allows an attacker to set arbitrary flags for the git-upload-pack command, which may lead to unauthorized data access, modification, or availability disruption of data handled by the library.

Mitigation & patch

Update the go-git library to version 5.13.0 or later, in which the vulnerability has been fixed. If immediate update is not possible, avoid using the file transport protocol in environments exposed to untrusted input data.

Who is affected

The go-git library (Go-Git project) in all versions prior to v5.13.0, when using the file transport protocol.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear