CVE-2025-21613

What it actually does

Argument injection into git-upload-pack flags via the file transport protocol, which causes go-git to shell out to the git binary with attacker-controlled arguments.

Why it matters to the business

Environments that clone or interact with repositories over the file:// protocol using vulnerable go-git versions risk unauthorized manipulation of Git operations, potentially leading to data exfiltration, repository tampering, or execution of unintended Git commands; the low EPSS and lack of KEV status indicate limited observed exploitation but still require prompt attention due to the 643 days since publication.

How an attack unfolds

An attacker supplies a crafted repository URL or path that uses the file transport; go-git invokes the git binary with the supplied arguments, allowing arbitrary flags to be passed to git-upload-pack without proper sanitization.

How to fix it

Upgrade go-git/go-git to the fixed commit 94bd4af1deb15a64e90c6287eaf9e9f09b192a1f (equivalent to v5.13 or later). Where upgrades are not immediately feasible, disable or avoid use of the file transport protocol entirely.

How to confirm the fix worked

Verify the go-git dependency version resolves to commit 94bd4af1deb15a64e90c6287eaf9e9f09b192a1f or newer; test that file:// URLs no longer permit injection of arbitrary git-upload-pack flags.

Typical attack path

1. Locate applications or dependencies that import go-git and perform Git operations
2. Identify code paths that accept or construct repository URLs using the file:// protocol
3. Craft a malicious URL or path containing injected git-upload-pack flags
4. Trigger the vulnerable code path to cause the shell-out with attacker-controlled arguments
5. Observe or leverage the resulting Git command behavior for further impact

How to detect it

Review application logs and process execution traces for invocations of git-upload-pack with unexpected or attacker-supplied flags originating from go-git file transport handling; correlate with repository URL inputs containing file://.

What your security team should do

• Immediately audit all codebases and dependencies for use of go-git with file transport
• Prioritize upgrade to the fixed commit across all affected packages
• Implement input validation or protocol whitelisting to block file:// usage until patched
• Monitor EPSS trend and reassess if exploitation maturity increases