CVE-2025-21613 go-git has an Argument Injection via the URL field
Attackers can inject arguments into git commands via the URL field when using the file transport protocol, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21613?
CVE-2025-21613 is a critical command injection vulnerability in go-git, published on 6 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
Weakness: CWE-88
Which versions are affected by CVE-2025-21613?
7 open source packages ship an affected version, including github.com/go-git/go-git/v5, github.com/go-git/go-git/v4 and gopkg.in/src-d/go-git.v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-git/go-git/v5 Go | All versions | 5.13.0 |
github.com/go-git/go-git/v5 Go | All versions | 5.13.0 |
github.com/go-git/go-git/v5 Go | All versions | 5.13.0 |
github.com/go-git/go-git/v4 Go | From 4.0.0 | None |
gopkg.in/src-d/go-git.v4 Go | From 4.0.0 | None |
gopkg.in/src-d/go-git.v4 Go | From 4.0.0 to 4.13.1 | None |
1 more packages
gopkg.in/src-d/go-git.v4 Go | From 4.0.0 to 4.13.1 | None |
Linux distribution packages (10)
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 3.3.1611.0-4.36.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 3.3.1611.0-150000.5.20.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.3.1611.0-150000.5.20.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 3.3.1611.0-150000.5.20.1 |
amazon-ssm-agent SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 3.3.1611.0-150000.5.20.1 |
amazon-ssm-agent openSUSE:Leap 15.6 | All versions | 3.3.1611.0-150000.5.20.1 |
amazon-ssm-agent openSUSE:Tumbleweed | All versions | 3.3.1611.0-1.1 |
brise openSUSE:Tumbleweed | All versions | 20230603+git.5fdd2d6-5.1 |
grafana openSUSE:Tumbleweed | All versions | 11.3.0-5.1 |
rz-pm openSUSE:Tumbleweed | All versions | 0.3.3+git~14~gcee0d0d-1.1 |
Products include Go-Git Project Go-Git.
How do I fix CVE-2025-21613?
Upgrade github.com/go-git/go-git/v5 to 5.13.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-21613 being exploited?
There is no known exploitation of CVE-2025-21613 in the wild and no public exploit code.
Other vulnerabilities in go-git
- CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
- CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies
- CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients
- CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
- CVE-2026-45571 go-git: Crafted repositories may modify main and submodule .git directories
Sources
Also known as AZL-55060, AZL-55067, AZL-55088, AZL-55094, CLEANSTART-2026-YJ06011, DEBIAN-CVE-2025-21613 and 13 more.