CVE-2026-45571: 
Packer vulnerability analysis and mitigation

CVE-2026-45571 is a path traversal vulnerability in go-git, an extensible Git implementation library written in pure Go. A path validation issue allows crafted repository data to write files outside the intended checkout target, including the repository's .git directory. The vulnerability affects go-git versions up to and including 5.19.0 (v5 branch) and 6.0.0-alpha.3 (v6 branch), and was disclosed on May 18–19, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, go-git Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). Upstream Git introduced path validation checks years ago to prevent checkout operations from writing files outside the working tree or into the .git directory; go-git drifted from these checks, leaving it vulnerable. An attacker crafts a malicious repository with specially constructed file paths (potentially using path traversal sequences or platform-specific encoding tricks) that, when cloned or checked out by a victim using go-git, cause files to be written outside the intended directory — including into the .git directory itself. Some attack vectors are platform-specific: certain payloads target only Windows users, others only macOS users, and some affect all platforms (go-git Advisory, Github Advisory).

Successful exploitation allows an attacker to write arbitrary files outside the intended checkout directory, including into the repository's .git directory, which can lead to integrity compromise (e.g., overwriting Git hooks to achieve code execution on subsequent Git operations) and limited availability impact. There is no confidentiality impact as the vulnerability does not expose data to the attacker. The impact extends to submodule handling as well — even configurations using isolated filesystem types (e.g., memfs for .git and osfs for the worktree) remain vulnerable when submodules are present, since submodule dotgit directories may still be materialized within the worktree context (go-git Advisory).

1. Craft a malicious repository: Create a Git repository containing files with path traversal sequences in their names (e.g., ../../.git/hooks/post-checkout or platform-specific variants using alternate encodings for Windows or macOS) that resolve to locations outside the intended checkout directory.
2. Host the repository: Make the malicious repository available via a Git hosting service, a self-hosted Git server, or distribute it directly (e.g., as a .tar archive or via a pull request).
3. Social engineer the victim: Convince a developer or automated CI/CD pipeline using go-git to clone or check out the malicious repository (e.g., via a dependency, a forked repository, or a seemingly legitimate project).
4. Trigger the checkout: When the victim's go-git-based application performs a Clone or Checkout operation, the library processes the crafted paths without adequate validation, writing files to attacker-controlled locations outside the worktree — including the .git/hooks/ directory.
5. Achieve code execution (post-exploitation): If a malicious file is written to .git/hooks/ (e.g., post-checkout, pre-commit), it will execute automatically on the next corresponding Git operation performed by the victim, enabling arbitrary command execution in the victim's environment (go-git Advisory).

• File System: Unexpected files written outside the repository's working directory after a git clone or checkout operation; files appearing in .git/hooks/ (e.g., post-checkout, pre-commit, post-merge) that were not explicitly created by the user; files with unusual names containing path traversal sequences (../, ..\, or URL-encoded equivalents) in the repository object store.
• Logs: Application logs from go-git-based tools showing file write operations to paths outside the expected worktree root; CI/CD pipeline logs indicating unexpected file creation during repository clone steps.
• Process: Unexpected script or binary execution triggered immediately after a Git clone or checkout operation, particularly processes spawned by Git hook scripts (e.g., shell interpreters, network tools) (go-git Advisory).

Users should upgrade go-git to version 5.19.1 (v5 branch) or 6.0.0-alpha.4 (v6 branch), which restore the path validation checks present in upstream Git. Versions prior to v5 are also likely affected and users are strongly recommended to migrate to a supported version. As a partial workaround (for the main repository only, not submodules), using non-descendant go-billy filesystem instances — such as storing the .git directory via memfs while using osfs for the worktree — can prevent .git directory manipulation, but this does not protect against submodule-related attack vectors. Users should exercise caution when cloning repositories from untrusted sources (go-git Advisory, Github Advisory).

The vulnerability was reported to the go-git project independently by three researchers: @kodareef5, @AyushParkara, and @N0zoM1z0. The advisory was published by maintainer @pjbgf on May 18, 2026. Red Hat has acknowledged the vulnerability and published a security advisory. The Pulumi Kubernetes project issued a patch commit referencing this CVE shortly after disclosure, indicating prompt uptake in the Go ecosystem (go-git Advisory, Red Hat CVE).