Read the docs
TI-2025-15573 Aliases CVE-2025-21613GHSA-v725-9546-7q7m

go-git has an Argument Injection via the URL field

Priority MEDIUM 44CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 19 fixed, 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-88.

Summary

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01278 70th percentileScored 2026-11-07
Fix Partial go-git (go-git): 5.13.0github.com/go-git/go-git/v5 (Go): 5.13.0Red Hat: 21 advisoriesRed Hat: 19 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-gitgo-git4.0.0 to before 5.13.05.13.0Patch availableCNA
—gopkg.in/src-d/go-git.v4 (Go)4.0.0 – 4.13.1—No fix listedGHSA-v725-9546-7q7m
—github.com/go-git/go-git/v5 (Go)before 5.13.05.13.0Patch availableGHSA-v725-9546-7q7m
  • go-git Vendorgo-git Affected 4.0.0 to before 5.13.0 Fixed in 5.13.0 Patch available CNA
  • gopkg.in/src-d/go-git.v4 (Go) Vendor— Affected 4.0.0 – 4.13.1 Fixed in — No fix listed GHSA-v725-9546-7q7m
  • github.com/go-git/go-git/v5 (Go) Vendor— Affected before 5.13.0 Fixed in 5.13.0 Patch available GHSA-v725-9546-7q7m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*before 5.13.0Vulnerablego-git
  • cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:* Versions before 5.13.0 Vulnerable ·go-git

Remediation

  • Fix · CNA go-git (go-git) Fixed in 5.13.0
  • Fix · GHSA-v725-9546-7q7m github.com/go-git/go-git/v5 (Go) Fixed in 5.13.0 Advisory →

Red Hat 21 advisories

  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2025:11396 Released 2025-07-18 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.4.5 security and bug fix update
    • 9Base-OADP-1.4 oadp/oadp-kubevirt-velero-plugin-rhel9, oadp/oadp-mustgather-rhel9, oadp/oadp-rhel9-operator +5
  • RHSA-2025:3344 Released 2025-03-27 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-9.el9_5, grafana-selinux-10.2.6-9.el9_5
Show 18 more Red Hat advisories
  • RHSA-2025:3069 Released 2025-03-20 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.14.3 security update
    • Red Hat OpenShift GitOps 1.14 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
  • RHSA-2025:1704 Released 2025-02-27 · Red Hat rating Important
    OpenShift Container Platform 4.16.36 security and extras update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-helm-rhel9-operator, openshift4/ose-operator-sdk-rhel9
  • RHSA-2025:1888 Released 2025-02-26 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.15.1 security update
    • Red Hat OpenShift GitOps 1.15 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8, openshift-gitops-1/argocd-rhel8 +7
  • RHSA-2025:1870 Released 2025-02-26 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1 (osp-director-operator) security update
    • Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-agent, rhosp-rhel9/osp-director-downloader, rhosp-rhel9/osp-director-operator +1
  • RHSA-2025:1869 Released 2025-02-26 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 (osp-director-operator) security update
    • Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
  • RHSA-2024:6122 Released 2025-02-25 · Red Hat rating Important
    OpenShift Container Platform 4.18.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/azure-service-rhel9-operator +47
  • RHSA-2024:6121 Released 2025-02-25 · Red Hat rating Important
    OpenShift Container Platform 4.18.1 security and extras update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ingress-node-firewall-rhel9-operator, openshift4/kube-compare-artifacts-rhel9 +47
  • RHSA-2025:1468 Released 2025-02-13 · Red Hat rating Important
    ACS 4.4 enhancement and security update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator +1
  • RHSA-2025:1334 Released 2025-02-11 · Red Hat rating Important
    ACS 4.5 enhancement and security update
    • RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator +5
  • RHSA-2025:1119 Released 2025-02-11 · Red Hat rating Important
    OpenShift Container Platform 4.17.16 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-helm-rhel9-operator, openshift4/ose-operator-sdk-rhel9, openshift4/ose-sriov-network-config-daemon-rhel9
  • RHSA-2025:0907 Released 2025-02-03 · Red Hat rating Critical
    ACS 4.6.2 enhancement and security update
    • RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2025:0754 Released 2025-01-28 · Red Hat rating Important
    Red Hat OpenShift Builds 1.2
    • Builds for Red Hat OpenShift 1.2.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
  • RHSA-2025:0654 Released 2025-01-28 · Red Hat rating Important
    OpenShift Container Platform 4.17.14 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-baremetal-cluster-api-controllers-rhel9 +6
  • RHSA-2025:0715 Released 2025-01-27 · Red Hat rating Important
    Red Hat OpenShift Builds 1.1
    • Builds for Red Hat OpenShift 1.1.1 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
  • RHSA-2025:0662 Released 2025-01-23 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) grafana-9.2.10-21.el9_4, grafana-selinux-9.2.10-21.el9_4
  • RHSA-2025:0445 Released 2025-01-20 · Red Hat rating Important
    Red Hat Trusted Profile Analyzer 1.2.2
    • Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9
  • RHSA-2025:0444 Released 2025-01-20 · Red Hat rating Important
    Red Hat Trusted Profile Analyzer 1.2.2
    • Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-guac-rhel9
  • RHSA-2025:0401 Released 2025-01-20 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-21.el8_10, grafana-selinux-9.2.10-21.el8_10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Builds for Red Hat OpenShiftAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
9Base-OADP-1.4Fixed RHSA-2025:11396
Builds for Red Hat OpenShift 1.1.1Fixed RHSA-2025:0715
Builds for Red Hat OpenShift 1.2.2Fixed RHSA-2025:0754
CNV 4.18 for RHEL 9Fixed—
RHACS 4.4 for RHEL 8Fixed RHSA-2025:1468
RHACS 4.5 for RHEL 8Fixed RHSA-2025:1334
RHACS 4.6 for RHEL 8Fixed RHSA-2025:0907
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:0401
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:3344
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:0662
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:1704
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:0654, RHSA-2025:1119
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2024:6121, RHSA-2024:6122
Red Hat OpenShift GitOps 1.14Fixed RHSA-2025:3069
Red Hat OpenShift GitOps 1.15Fixed RHSA-2025:1888
Red Hat OpenStack Platform 16.2Fixed RHSA-2025:1869
Red Hat OpenStack Platform 17.1Fixed RHSA-2025:1870
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
Red Hat Trusted Profile Analyzer 1.2Fixed RHSA-2025:0444, RHSA-2025:0445
Not affected: 12 products
  • 9Base-OADP-1.4
  • Builds for Red Hat OpenShift 1.1.1
  • Builds for Red Hat OpenShift 1.2.2
  • RHACS 4.4 for RHEL 8
  • RHACS 4.5 for RHEL 8
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-21613
  2. 2026-10-03 Alias added: GHSA-v725-9546-7q7m
  3. 2026-10-30 Fix available: CNV 4.18 for RHEL 9 · Red Hat

References

Advisory 2

Other 1

  • TI-2023-27070 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVSS 3.1CRITICAL 9.8
  • TI-2025-15574 go-git clients vulnerable to DoS via maliciously crafted Git server replies CVSS 3.1HIGH 7.5
  • TI-2023-27069 Maliciously crafted Git server replies can cause DoS on go-git clients CVSS 3.1HIGH 7.5
  • TI-2026-30091 go-git Credential leak via cross-host redirect in smart HTTP transport CVSS 3.1HIGH 7.4
  • TI-2026-32877 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git CVSS 4.0HIGH 7.0
  • TI-2026-33320 go-git: Crafted repositories may modify main and submodule .git directories CVSS 3.1MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences