VDB
CVE-2026-71557
CVE-2026-71557
PUBLISHED
CVSS 6.300000190734863 MEDIUM
go-git: Malicious reference names may modify files outside the reference storage
EPSS 0.41% · 33.6th percentile
Risk Scores
CVSS 3.1
6.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
EPSS Score
0.41%
33.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | gitsign | 0, 0, 0 |
| chainguard | gitaly-19.1 | 0, 0, 0 |
| chainguard | external-secrets-operator-2.1 | 0, 0, 0 |
| chainguard | dagger | 0, 0, 0 |
| wolfi | act | 0, 0, 0 |
| chainguard | kubescape | 0, 0, 0 |
| wolfi | kyverno-1.18 | 0, 0, 0 |
| wolfi | bom | 0, 0, 0 |
| chainguard | argo-cd-fips-3.3 | 0, 0, 0 |
| wolfi | kubescape | 0, 0, 0 |
| wolfi | gitsign | 0, 0, 0 |
| wolfi | flux-notification-controller | 0, 0, 0 |
| chainguard | crossplane-fips-2.0 | 0, 0, 0 |
| chainguard | gitaly-19.0 | 0, 0, 0 |
| chainguard | gptscript | 0, 0, 0 |
| chainguard | packer-fips | 0, 0, 0 |
| chainguard | gitlab-runner-fips-19.0 | 0, 0, 0 |
| chainguard | kots | 0, 0, 0 |
| github.com | go-git/go-git/v5 | 0, 0, 0 |
| chainguard | grafana-12.1 | 0, 0, 0 |
…and 241 more
Timeline
- Aug 7, 2026 CVE Published
- Aug 7, 2026 Coalition ESS Score
- Aug 8, 2026 EPSS Score
- Aug 9, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-71557 advisory
- https://github.com/advisories/GHSA-qgq7-7hm3-q39j advisory
- https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j url
- https://github.com/go-git/go-git/pull/2247 patch
- https://github.com/go-git/go-git/pull/2254 patch
- https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7 patch
- https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36 patch
- https://github.com/go-git/go-git/releases/tag/v5.19.2 url
- https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5 url