Go-Git — CraftedSignal Threat Feed

CVE-2026-45571 go-git Crafted Repositories Modify .git Directories

hello@craftedsignal.io — Thu, 28 May 2026 07:25:12 +0000

CVE-2026-45571 is a critical vulnerability affecting the go-git library, a popular Go implementation of Git. This flaw allows a malicious actor to craft a Git repository that, when processed by a vulnerable application using go-git, can modify the .git directories of both the main repository and its submodules. This modification could be leveraged to overwrite configuration files, inject malicious Git hooks, or otherwise compromise the integrity of the repository and the system on which it resides. Successful exploitation could lead to arbitrary code execution or sensitive information disclosure. Defenders should prioritize identifying and mitigating applications utilizing vulnerable versions of go-git.

Attack Chain

An attacker crafts a malicious Git repository containing specially crafted files or symbolic links designed to manipulate .git directories.
A user or automated system clones or interacts with the malicious repository using a vulnerable version of go-git.
The vulnerable go-git library processes the malicious repository content without proper validation or sanitization.
The crafted content overwrites or modifies configuration files within the main repository’s .git directory.
The crafted content also propagates to any submodules present, modifying their respective .git directories.
The modification of .git directories allows the attacker to inject malicious Git hooks (e.g., pre-commit, post-receive).
When a user performs Git operations (e.g., commit, push, pull), the injected malicious hooks are executed.
The malicious hooks execute arbitrary code, potentially leading to complete system compromise or data exfiltration.

Impact

Successful exploitation of CVE-2026-45571 can have severe consequences. An attacker could gain arbitrary code execution on systems using vulnerable versions of go-git. This could lead to data breaches, system compromise, and denial-of-service attacks. The vulnerability poses a significant risk to organizations that rely on go-git for managing source code, configuration files, or other sensitive data within Git repositories. The lack of specific victim count data makes assessing the total impact difficult, but the wide usage of go-git implies a potentially broad attack surface.

Recommendation

Upgrade go-git to a patched version that addresses CVE-2026-45571.
Implement the Sigma rule “Detect Go-Git .git Directory Modification” to detect potential exploitation attempts in real-time.
Review and audit existing Git repositories for suspicious files or symbolic links that could be used to exploit this vulnerability.
Monitor file system events within .git directories using the Sigma rule “Detect Git Hook Creation in .git Directory” to identify unauthorized modifications.

go-git Improper Parsing of Malformed Git Objects

hello@craftedsignal.io — Mon, 11 May 2026 14:48:49 +0000

The go-git library, a Git implementation written in Go, is vulnerable to improper parsing of specially crafted Git objects. Specifically, when commit or tag objects contain ambiguous or malformed headers, go-git may expose values differently from how Git itself would interpret or reject the same object. The vulnerability also affects commit signing and verification logic, potentially leading to the acceptance of signatures for commits whose displayed metadata differs from the original signed object. This issue impacts go-git/go-git/v6 versions from 6.0.0-alpha.1 to 6.0.0-alpha.2 and go-git/go-git/v5 versions prior to 5.19.0. This vulnerability matters because it can lead to security bypasses where a user trusts a commit that has been altered, leading to supply chain attacks or other forms of code compromise. The CVE associated with this vulnerability is CVE-2026-45022.

Attack Chain

An attacker crafts a malicious Git repository containing a commit or tag object with malformed headers.
The malformed object is designed to exploit the parsing differences between go-git and upstream Git.
A user or system clones or fetches the malicious repository using a vulnerable version of go-git.
go-git parses the malformed object, leading to an inconsistent internal representation of the commit or tag.
If commit signing or verification is performed, go-git operates on the reconstructed data.
The signing process uses the altered commit payload, resulting in a signature that doesn’t match the original object.
During verification, go-git might accept a signature for a commit whose metadata differs from the intended signed version.
The user trusts the commit based on the seemingly valid signature, potentially introducing malicious code or configuration.

Impact

The vulnerability in go-git could lead to the acceptance of malicious code into a project, even if it is signed. This can occur because go-git may incorrectly verify a commit signature due to parsing differences. The number of victims is potentially large, as go-git is a widely used library in the Go ecosystem. Targeted sectors include software development, DevOps, and any industry relying on Git for version control and software distribution. A successful attack could compromise software integrity, leading to supply chain attacks and data breaches.

Recommendation

Upgrade to go-git/go-git/v5 version 5.19.0 or later to address CVE-2026-45022.
If using go-git/go-git/v6, avoid versions between 6.0.0-alpha.1 and 6.0.0-alpha.2.
Implement integrity checks on Git objects to detect inconsistencies between go-git’s representation and the actual object data.

go-git Improper Parsing of Malformed Git Objects

hello@craftedsignal.io — Mon, 11 May 2026 14:48:49 +0000

Attack Chain

An attacker crafts a malicious Git repository containing a commit or tag object with malformed headers.
The malformed object is designed to exploit the parsing differences between go-git and upstream Git.
A user or system clones or fetches the malicious repository using a vulnerable version of go-git.
go-git parses the malformed object, leading to an inconsistent internal representation of the commit or tag.
If commit signing or verification is performed, go-git operates on the reconstructed data.
The signing process uses the altered commit payload, resulting in a signature that doesn’t match the original object.
During verification, go-git might accept a signature for a commit whose metadata differs from the intended signed version.
The user trusts the commit based on the seemingly valid signature, potentially introducing malicious code or configuration.

Impact

Recommendation

Upgrade to go-git/go-git/v5 version 5.19.0 or later to address CVE-2026-45022.
If using go-git/go-git/v6, avoid versions between 6.0.0-alpha.1 and 6.0.0-alpha.2.
Implement integrity checks on Git objects to detect inconsistencies between go-git’s representation and the actual object data.