CVE-2025-21613
ADVISORY - githubSummary
Impact
An argument injection vulnerability was discovered in go-git versions prior to v5.13.
Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries.
Affected versions
Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
Workarounds
In cases where a bump to the latest version of go-git is not possible, we recommend users to enforce restrict validation rules for values passed in the URL field.
Credit
Thanks to @vin01 for responsibly disclosing this vulnerability to us.
Common Weakness Enumeration (CWE)
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
NIST
3.9
CVSS SCORE
9.2criticalGitHub
3.9
CVSS SCORE
9.2criticalDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumGoLang
-
Alma
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighAmazon
-
CVSS SCORE
N/AhighRed Hat
2.2
CVSS SCORE
8.1highRocky
-
CVSS SCORE
N/AhighOracle
-
CVSS SCORE
N/AhighChainguard
CGA-2562-q3f7-wq63
-
Chainguard
CGA-2gw7-q958-rqwh
-
Chainguard
CGA-2pmx-4jvr-5fh2
-
Chainguard
CGA-3jjj-5c29-v6m2
-
Chainguard
CGA-3jvx-c583-733j
-
Chainguard
CGA-3ppc-m82p-45r9
-
Chainguard
CGA-3xqm-c5wx-hjfp
-
Chainguard
CGA-44m4-m589-h366
-
Chainguard
CGA-4723-8p2f-mqv6
-
Chainguard
CGA-489m-x2wg-g49v
-
Chainguard
CGA-4fww-c4xq-q3m5
-
Chainguard
CGA-4x4g-v2cj-jv9p
-
Chainguard
CGA-52r4-787f-9qrc
-
Chainguard
CGA-576g-jv9m-gr4c
-
Chainguard
CGA-5h53-f4mc-5g7m
-
Chainguard
CGA-5q57-5c9f-mg8f
-
Chainguard
CGA-5qm6-hh2w-3mq3
-
Chainguard
CGA-5x53-q945-q88h
-
Chainguard
CGA-5xrg-m884-hm48
-
Chainguard
CGA-63fc-j3h2-ghc8
-
Chainguard
CGA-65rx-fh74-p426
-
Chainguard
CGA-6628-w2vg-8365
-
Chainguard
CGA-6823-c2q6-5r5f
-
Chainguard
CGA-69ph-pjx5-9wj7
-
Chainguard
CGA-6qc4-fhfq-4gq7
-
Chainguard
CGA-76wv-2jg5-vrrv
-
Chainguard
CGA-7739-w2fq-74jc
-
Chainguard
CGA-79gx-gphx-3mc5
-
Chainguard
CGA-79qh-gg5h-2xcg
-
Chainguard
CGA-7c8g-6q5g-4p65
-
Chainguard
CGA-7mgg-p75m-fhp2
-
Chainguard
CGA-7v2v-j773-9hh5
-
Chainguard
CGA-7x2r-jvx7-38h9
-
Chainguard
CGA-84gv-mx26-6wpj
-
Chainguard
CGA-8gmj-w7qg-pmcw
-
Chainguard
CGA-8jqf-m7w3-vp9j
-
Chainguard
CGA-9393-h7qv-437w
-
Chainguard
CGA-96x6-8r9x-5v7q
-
Chainguard
CGA-985j-mpqm-gmq5
-
Chainguard
CGA-9j6c-fxv2-wc33
-
Chainguard
CGA-c32h-ccm6-3vcv
-
Chainguard
CGA-ccvc-56mj-q9jw
-
Chainguard
CGA-cfvf-q7hm-jmmw
-
Chainguard
CGA-ch5f-w59m-p77r
-
Chainguard
CGA-cv6j-2q78-849x
-
Chainguard
CGA-cxxw-ww5f-xfjm
-
Chainguard
CGA-f39c-cmxc-xx62
-
Chainguard
CGA-f42v-q6c4-cx7m
-
Chainguard
CGA-f5vf-w399-j39m
-
Chainguard
CGA-f7gg-xcpf-x9gh
-
Chainguard
CGA-f7mr-58rr-gg27
-
Chainguard
CGA-f7wh-pvcw-52vq
-
Chainguard
CGA-f88x-fxpg-h67j
-
Chainguard
CGA-f9v2-mx43-f44p
-
Chainguard
CGA-fvw4-hwxq-jhx7
-
Chainguard
CGA-fw42-833q-6mq3
-
Chainguard
CGA-g225-5vp7-phqm
-
Chainguard
CGA-g452-6jh5-mhx2
-
Chainguard
CGA-g8qq-fhq3-2j3r
-
Chainguard
CGA-g8rg-23jq-4v58
-
Chainguard
CGA-gc7x-m93r-gv32
-
Chainguard
CGA-gjx7-f469-94jq
-
Chainguard
CGA-gp2q-hf8j-2x67
-
Chainguard
CGA-gqc9-hc28-p9pg
-
Chainguard
CGA-gr8m-q6jf-rh2f
-
Chainguard
CGA-gx3v-fxp6-q2vr
-
Chainguard
CGA-h3q4-57gf-67j9
-
Chainguard
CGA-h689-mp2v-73rm
-
Chainguard
CGA-hj95-286v-4qj5
-
Chainguard
CGA-hm9m-px98-5gr8
-
Chainguard
CGA-hvpq-p2rm-xw65
-
Chainguard
CGA-hw7r-f52f-m3rg
-
Chainguard
CGA-hwpw-cmjx-86rw
-
Chainguard
CGA-hxf4-2623-mmmh
-
Chainguard
CGA-j2rp-m2w5-7m27
-
Chainguard
CGA-j73v-8j3q-5rc6
-
Chainguard
CGA-j7p3-fc67-phch
-
Chainguard
CGA-jcpv-55mh-wp63
-
Chainguard
CGA-jhf4-pqvp-hxvr
-
Chainguard
CGA-jpr9-54qf-qxcg
-
Chainguard
CGA-jq7r-f6qh-5383
-
Chainguard
CGA-jw69-p35g-9w49
-
Chainguard
CGA-m4f3-x9vr-m54m
-
Chainguard
CGA-m62m-2rm3-g6pq
-
Chainguard
CGA-m7cr-h2vc-67q9
-
Chainguard
CGA-m7w4-9gvg-jg6v
-
Chainguard
CGA-p75x-8qj2-hrj6
-
Chainguard
CGA-p772-f7g3-9mf8
-
Chainguard
CGA-pcc8-xh9f-57f4
-
Chainguard
CGA-ppvc-598f-24vh
-
Chainguard
CGA-pqcv-w9h9-chh3
-
Chainguard
CGA-q827-pgvp-wh74
-
Chainguard
CGA-q8xv-qpf6-7qwh
-
Chainguard
CGA-qmmh-7pp9-7h68
-
Chainguard
CGA-qp62-rh46-26hw
-
Chainguard
CGA-qpmh-ff4c-jrhx
-
Chainguard
CGA-qwfv-fhw8-r3q9
-
Chainguard
CGA-r5v9-2qgc-4p4c
-
Chainguard
CGA-r684-j2qw-845r
-
Chainguard
CGA-r9x8-82fc-m5hp
-
Chainguard
CGA-rg5q-w978-798c
-
Chainguard
CGA-rpmq-2h2m-hc99
-
Chainguard
CGA-rqmw-59qj-32c6
-
Chainguard
CGA-rrm5-9358-m9fg
-
Chainguard
CGA-v4hw-fvq8-6crg
-
Chainguard
CGA-wjw3-52wx-2q53
-
Chainguard
CGA-x37r-j7w5-4xr4
-
Chainguard
CGA-x68h-g3fx-w43c
-
Chainguard
CGA-x83w-42w5-hjv4
-
Chainguard
CGA-xw2h-vxp4-vfvg
-
minimos
MINI-8w3m-f3jr-mxxp
-
minimos
MINI-gc49-jjpm-94vg
-