CVE-2025-21613 (Critical) detected in github.com/go-git/go-git-v5.2.0

[mend-bolt-for-github]

CVE-2025-21613 - Critical Severity Vulnerability

Vulnerable Library - github.com/go-git/go-git-v5.2.0

A highly extensible Git implementation in pure Go.

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy:

• ❌ github.com/go-git/go-git-v5.2.0 (Vulnerable Library)

Found in HEAD commit: df1f7d3f67826e841793324e4796be4fbd91c00f

Found in base branch: main

Vulnerability Details

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Publish Date: 2025-01-06

URL: CVE-2025-21613

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v725-9546-7q7m

Release Date: 2025-01-06

Fix Resolution: github.com/go-git/go-git-v5.13.0

---

Step up your Open Source Security Game with Mend here