Threats tagged 'ghsa-hc8v-wwc9-vgxm'

CVE-2026-71556 is a symlink traversal vulnerability in the go-git library's worktree operations. It allows an attacker who can introduce or control symbolic links in the worktree to cause write operations to affect files outside the intended directory, including Git metadata files like .git/config. This occurs because the filesystem wrapper did not prevent following existing symlinks in any path component. The issue is fixed in go-git versions 5.19.2 and 6.0.0-alpha.5 by enforcing symlink-safe boundaries in worktree filesystem operations.