CVE-2025-21613: go-git has an Argument Injection via the URL field
Impact An argument injection vulnerability was discovered in go-git versions prior to v5.13.
Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries.
Affected versions Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
Workarounds In cases where a bump to the latest version of go-git is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field.
Credit Thanks to @vin01 for responsibly disclosing this vulnerability to us.
Other sources
go-git has an Argument Injection via the URL field
— Microsoft
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21613?
The severity of CVE-2025-21613 has not been officially assigned but is considered significant due to the potential for argument injection in git-upload-pack.
How do I fix CVE-2025-21613?
To fix CVE-2025-21613, upgrade to `go-git` version 5.13.0 or later.
What versions are affected by CVE-2025-21613?
CVE-2025-21613 affects `go-git` versions before v5.13 and `gopkg.in/src-d/go-git.v4` versions from 4.0.0 to 4.13.1.
What happens if CVE-2025-21613 is exploited?
If exploited, CVE-2025-21613 could allow an attacker to set arbitrary values to git-upload-pack flags, potentially affecting repository interactions.
Is CVE-2025-21613 a remote or local vulnerability?
CVE-2025-21613 is considered a remote vulnerability as it can be exploited through networked interactions with git repositories.