Threats affecting pkg:golang/github.com/go-git/go-billy

The go-billy filesystem abstraction for Go prior to version 5.9.0 and including 6.0.0-alpha.1 contains vulnerabilities related to uncontrolled recursion and improper handling of malformed input. These issues can cause panics, infinite loops, or excessive resource consumption due to missing safety mechanisms like cycle detection and recursion limits. The vulnerability has been addressed in versions 5.9.0 and 6.0.0-alpha.1.

Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.