{"schema_version":"1.7.3","id":"GHSA-v725-9546-7q7m","published":"2025-01-06T16:16:30Z","modified":"2026-02-04T02:48:44.624420Z","aliases":["CVE-2025-21613","GO-2025-3368"],"related":["CGA-5q5q-jv78-gpg3"],"summary":"go-git has an Argument Injection via the URL field","details":"### Impact\nAn argument injection vulnerability was discovered in `go-git` versions prior to `v5.13`. \n\nSuccessful exploitation of this vulnerability could allow an attacker to set arbitrary values to [git-upload-pack flags](https://git-scm.com/docs/git-upload-pack). This only happens when the `file` transport protocol is being used, as that is the only protocol that shells out to `git` binaries.\n\n### Affected versions\nUsers running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.13` in order to mitigate this vulnerability.\n\n### Workarounds\nIn cases where a bump to the latest version of `go-git` is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field.\n\n## Credit\nThanks to @vin01 for responsibly disclosing this vulnerability to us.","affected":[{"package":{"name":"gopkg.in/src-d/go-git.v4","ecosystem":"Go","purl":"pkg:golang/gopkg.in/src-d/go-git.v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"last_affected":"4.13.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-v725-9546-7q7m/GHSA-v725-9546-7q7m.json"}},{"package":{"name":"github.com/go-git/go-git/v5","ecosystem":"Go","purl":"pkg:golang/github.com/go-git/go-git/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-v725-9546-7q7m/GHSA-v725-9546-7q7m.json"}}],"references":[{"type":"WEB","url":"https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21613"},{"type":"PACKAGE","url":"https://github.com/go-git/go-git"}],"database_specific":{"cwe_ids":["CWE-88"],"github_reviewed":true,"github_reviewed_at":"2025-01-06T16:16:30Z","nvd_published_at":"2025-01-06T17:15:47Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear"}]}