Go-Git

A symlink traversal vulnerability in the go-git library (CVE-2026-71556) enables unauthorized write access outside of the intended worktree directory when processing malicious symbolic links.

Multiple path traversal vulnerabilities exist in go-billy, particularly affecting the `osfs.ChrootOS` implementation, where crafted paths can escape intended base directories due to insufficient path sanitization and boundary enforcement; users requiring stronger security should upgrade to v6 and use `os.Root`.