CVE-2025-21613 json
go-git has an Argument Injection via the URL field
published 2025-01-06 22 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-0045 , GHSA-v725-9546-7q7m , GO-2025-3368
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
Patch / fix
- go github.com/go-git/go-git/v5 5.13.0
- go-git_project go-git 5.13.0
- golang-github-go-git-go-git Debian 14, Debian 13 5.13.2-1
debian advisories DEBIAN-CVE-2025-21613
- golang-github-go-git-go-git Ubuntu Pro 22.04 LTS 5.4.2-3ubuntu0.1~esm1
- golang-github-go-git-go-git Ubuntu Pro 24.04 LTS 5.4.2-4ubuntu0.24.04.3+esm2
ubuntu advisories UBUNTU-CVE-2025-21613
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- grafana RHEL 9 10.2.6-9.el9_5
- grafana-selinux RHEL 9 10.2.6-9.el9_5
- grafana RHEL 8 9.2.10-21.el8_10
- grafana-selinux RHEL 8 9.2.10-21.el8_10
- grafana RHEL 9.4 EUS 9.2.10-21.el9_4
- grafana-selinux RHEL 9.4 EUS 9.2.10-21.el9_4
red hat advisories RHSA-2025:3344RHSA-2025:0662RHSA-2025:0401
- grafana Manager Client Tools 15 10.4.15-150000.1.71.1
- grafana SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 10.4.15-150200.3.64.1
- grafana Manager Client Tools 12 10.4.15-1.71.1
- brise SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 20230603+git.5fdd2d6-150600.3.8.1
- amazon-ssm-agent SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 +2 more 3.3.1611.0-150000.5.20.1
- amazon-ssm-agent SLE Module for Public Cloud 12 3.3.1611.0-4.36.1
- govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250108T191942-150000.1.26.1
suse advisories SUSE-SU-2025:0624-1SUSE-SU-2025:0623-1SUSE-SU-2025:0622-1SUSE-SU-2025:0601-1SUSE-SU-2025:0277-1SUSE-SU-2025:0191-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- cheat openSUSE Leap 16.0 4.4.2-bp160.2.1
- cheat openSUSE Tumbleweed 4.4.2-2.1
- rz-pm openSUSE Tumbleweed 0.3.3+git~14~gcee0d0d-1.1
- rime-plum-go openSUSE Tumbleweed 1.0.3-1.1
- brise openSUSE Tumbleweed 20230603+git.5fdd2d6-5.1
- trivy Package Hub 15 SP6, openSUSE Leap 15.6 0.58.2-bp156.2.6.1
- trivy openSUSE Tumbleweed 0.58.2-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2025:20177-1openSUSE-SU-2025:15487-1openSUSE-SU-2025:15438-1openSUSE-SU-2025:14902-1openSUSE-SU-2025:14752-1
- grafana AlmaLinux 8 9.2.10-21.el8_10
- grafana-selinux AlmaLinux 8 9.2.10-21.el8_10
almalinux advisories ALSA-2025:0401
- grafana Rocky Linux 8 9.2.10-21.el8_10
rocky linux advisories RLSA-2025:0401
- packer Azure Linux 3.0 1.9.5-5
- cri-o CBL-Mariner 2.0 1.22.3-12
- packer CBL-Mariner 2.0 1.9.5-7
azure linux advisories AZL-55060AZL-55088AZL-55094
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-21613 updated cvss 8.1
go-git: argument injection via the URL field
-
Red Hat Builds for Red Hat OpenShift openshift-builds-image-bundler-rhel9affected: workaround, no fix available “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.”
-
Red Hat OpenShift Developer Tools and Services odoaffected: workaround, no fix planned “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.”
-
Red Hat OpenShift Serverless openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/kn-client-cli-artifacts-rhel9, serverless-1/openshift-serverless-1-func-utils-rhel8-container Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/submariner-rhel8-operator, rhacm2/multicluster-operators-subscription-rhel8 Red Hat Ceph Storage 7 rhceph/grafana-rhel9 Red Hat OpenShift AI (RHOAI) odh-data-science-pipelines-argo-argoexec-rhel8, odh-data-science-pipelines-argo-workflowcontroller-containeraffected: workaround, no fix available “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.”
-
Red Hat OpenShift Container Platform 4 openshift4/ose-consoleaffected: workaround, no fix planned “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.”
-
Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operatoraffected: workaround, no fix available “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.”
-
Red Hat Builds for Red Hat OpenShift 1.1.1 openshift-builds 1.1.1-1737591936fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:0715
-
Red Hat Builds for Red Hat OpenShift 1.2.2 openshift-builds 1.2.1-1737588912fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:0754
-
Red Hat CNV 4.18 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.18.1-3, container-native-virtualization/pr-helper-rhel9 v4.18.1-4, container-native-virtualization/aaq-server-rhel9 v4.18.1-2, container-native-virtualization/virtio-win-rhel9 v4.18.1-2, container-native-virtualization/wasp-agent-rhel9 v4.18.1-3, container-native-virtualization/kubemacpool-rhel9 v4.18.1-2, +48 morefixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHEA-2025:3152
show 17 moreshow fewer
-
Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-mustgather-rhel9 1.4.5-34fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:11396
-
Red Hat Enterprise Linux AppStream (v. 8) grafana 9.2.10-21.el8_10, grafana-selinux 9.2.10-21.el8_10fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:0401
-
Red Hat Enterprise Linux AppStream (v. 9) grafana 10.2.6-9.el9_5, grafana-selinux 10.2.6-9.el9_5fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:3344
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) grafana 9.2.10-21.el9_4, grafana-selinux 9.2.10-21.el9_4fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:0662
-
Red Hat OpenShift Container Platform 4.16 openshift4/ose-operator-sdk-rhel9 v4.16.0-202502190034.p0.g26e182e.assembly.stream.el9, openshift4/ose-helm-rhel9-operator v4.16.0-202502130836.p0.g26e182e.assembly.stream.el9fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:1704
-
Red Hat OpenShift Container Platform 4.17 openshift4/oc-mirror-plugin-rhel9 v4.17.0-202501221434.p0.g39bedc7.assembly.stream.el9, openshift4/ose-operator-sdk-rhel9 v4.17.0-202502051104.p0.g61a705e.assembly.stream.el9, openshift4/ose-helm-rhel9-operator v4.17.0-202502051104.p0.g61a705e.assembly.stream.el9fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:0654
-
Red Hat OpenShift Container Platform 4.18 openshift4/metallb-rhel9 v4.18.0-202502041632.p0.gdcee704.assembly.stream.el9, openshift4/ose-ptp-rhel9 v4.18.0-202501230001.p0.gcc2e8c8.assembly.stream.el9, openshift4/rdma-cni-rhel9 v4.18.0-202501230001.p0.g36ae553.assembly.stream.el9, openshift4/sriov-cni-rhel9 v4.18.0-202501230001.p0.g150a2eb.assembly.stream.el9, openshift4/ose-dpu-cni-rhel9 v4.18.0-202501230001.p0.g99f3e30.assembly.stream.el9, openshift4/ose-dpu-daemon-rhel9 v4.18.0-202501230001.p0.g99f3e30.assembly.stream.el9, +50 morefixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2024:6121
-
Red Hat Openshift Data Foundation 4.22 odf4/cephcsi-rhel9 1782932114, odf4/odf-cli-rhel9 1783537001, odf4/mcg-core-rhel9 1783536000, odf4/odf-drbd-rhel9 1783537392, odf4/odf-console-rhel9 1783537586, odf4/devicefinder-rhel9 1782932104, +21 morefixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2026:37387
-
Red Hat OpenShift GitOps 1.14 openshift-gitops-1/dex-rhel8 v1.14.3-4, openshift-gitops-1/argocd-rhel8 v1.14.3-4, openshift-gitops-1/argocd-rhel9 v1.14.3-1, openshift-gitops-1/gitops-rhel8 v1.14.3-4, openshift-gitops-1/must-gather-rhel8 v1.14.3-4, openshift-gitops-1/kam-delivery-rhel8 v1.14.3-4, +4 morefixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:3069
-
Red Hat OpenShift GitOps 1.15 openshift-gitops-1/dex-rhel8 v1.15.1-7, openshift-gitops-1/argocd-rhel8 v1.15.1-7, openshift-gitops-1/argocd-rhel9 v1.15.1-1, openshift-gitops-1/gitops-rhel8 v1.15.1-7, openshift-gitops-1/must-gather-rhel8 v1.15.1-7, openshift-gitops-1/argo-rollouts-rhel8 v1.15.1-7, +4 morefixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:1888
-
Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent 1.3.0-17, rhosp-rhel8/osp-director-operator 1.3.0-15, rhosp-rhel8/osp-director-downloader 1.3.0-17, rhosp-rhel8/osp-director-operator-bundle 1.3.0-33fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:1869
-
Red Hat OpenStack Platform 17.1 rhosp-rhel9/osp-director-agent 1.3.1-20, rhosp-rhel9/osp-director-operator 1.3.1-20, rhosp-rhel9/osp-director-downloader 1.3.1-18, rhosp-rhel9/osp-director-operator-bundle 1.3.1-41fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:1870
-
Red Hat Trusted Profile Analyzer 1.2 rhtpa 1.2.2-1736774679, rhtpa 1.2.2-1736863185fixed: fixed in 1.2.2 “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:0444
-
Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.8-2, advanced-cluster-security/rhacs-roxctl-rhel8 4.4.8-2, advanced-cluster-security/rhacs-rhel8-operator 4.4.8-2fixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:1468
-
Red Hat RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.5.6-2, advanced-cluster-security/rhacs-roxctl-rhel8 4.5.6-2, advanced-cluster-security/rhacs-scanner-rhel8 4.5.6-2, advanced-cluster-security/rhacs-rhel8-operator 4.5.6-2, advanced-cluster-security/rhacs-scanner-v4-rhel8 4.5.6-2, advanced-cluster-security/rhacs-scanner-slim-rhel8 4.5.6-2, +1 morefixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:1334
-
Red Hat RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.6.2-2, advanced-cluster-security/rhacs-roxctl-rhel8 4.6.2-2, advanced-cluster-security/rhacs-scanner-rhel8 4.6.2-2, advanced-cluster-security/rhacs-rhel8-operator 4.6.2-2, advanced-cluster-security/rhacs-collector-rhel8 4.6.2-2, advanced-cluster-security/rhacs-operator-bundle 4.6.2-2, +7 morefixed: vendor fix “In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field.” RHSA-2025:0907
-
Red Hat Builds for Red Hat OpenShift 1.1.1 openshift-builds 1.1.1-1737550023, openshift-builds 1.1.1-1737550042, openshift-builds 1.1.1-1737550043, openshift-builds 1.1.1-1737550185, openshift-builds 1.1.1-1737550210, openshift-builds 1.1.1-1737590574, +3 more Red Hat Builds for Red Hat OpenShift 1.2.2 openshift-builds 1.2.1-1737468833, openshift-builds 1.2.1-1737547771, openshift-builds 1.2.1-1737548078, openshift-builds 1.2.1-1737549219, openshift-builds 1.2.1-1737591360, openshift-builds 1.2.1-1737591508, +2 more Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-velero-rhel9 1.4.5-20, oadp/oadp-rhel9-operator 1.4.5-20, oadp/oadp-operator-bundle 1.4.5-34, oadp/oadp-velero-plugin-rhel9 1.4.5-18, oadp/oadp-velero-plugin-for-aws-rhel9 1.4.5-19, oadp/oadp-velero-plugin-for-gcp-rhel9 1.4.5-18, +4 more Red Hat OpenShift Container Platform 4 cri-o, openshift-clients, openshift4/ose-cli, openshift4/ose-deployer, openshift4/ose-tools-rhel9, openshift4/ose-cli-artifacts, +5 more Red Hat OpenShift Container Platform 4.16 openshift4/ptp-must-gather-rhel9 v4.16.0-202502121504.p0.g599fb3a.assembly.stream.el9, openshift4/nmstate-console-plugin-rhel9 v4.16.0-202502190034.p0.gc538911.assembly.stream.el9, openshift4/ose-sriov-network-rhel9-operator v4.16.0-202502171404.p0.g6e87e04.assembly.stream.el9, openshift4/kubernetes-nmstate-rhel9-operator v4.16.0-202502190034.p0.g20c879e.assembly.stream.el9, openshift4/ose-kubernetes-nmstate-handler-rhel9 v4.16.0-202502180904.p0.g20c879e.assembly.stream.el9, openshift4/sriov-network-metrics-exporter-rhel9 v4.16.0-202502171404.p0.gcb10e78.assembly.stream.el9, +2 more Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202501220426-0, openshift4/ose-cli-rhel9 v4.17.0-202501081137.p0.gae1bd9e.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.17.0-202501210306.p0.gf4192de.assembly.stream.el9, openshift4/ose-tools-rhel9 v4.17.0-202501081137.p0.gae1bd9e.assembly.stream.el9, openshift4/ose-ironic-rhel9 v4.17.0-202501202034.p0.gfaddbac.assembly.stream.el9, openshift4/ose-console-rhel9 v4.17.0-202501212004.p0.g247e0ce.assembly.stream.el9, +54 morenot affected: vulnerable code not present
+6 more productsfewer
Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202502100215-0, openshift4/frr-rhel9 v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.18.0-202502040032.p0.ga50d4c0.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.18.0-202502051032.p0.gacb9630.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.18.0-202501230001.p0.g914783c.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.18.0-202502110432.p0.g0c7bed9.assembly.stream.el9, +181 more Red Hat Openshift Data Foundation 4.22 odf4/mcg-operator-bundle 1783538986, odf4/ocs-operator-bundle 1783539176, odf4/odf-operator-bundle 1783539513, odf4/cephcsi-operator-bundle 1783538908, odf4/odr-hub-operator-bundle 1783539596, odf4/rook-ceph-operator-bundle 1783539714, +10 more Red Hat OpenShift Dev Spaces devspaces/devspaces-rhel8-operator Red Hat OpenStack Platform 16.2 osp-director-provisioner-container Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-scanner-rhel8 4.4.8-2, advanced-cluster-security/rhacs-collector-rhel8 4.4.8-2, advanced-cluster-security/rhacs-operator-bundle 4.4.8-2, advanced-cluster-security/rhacs-central-db-rhel8 4.4.8-2, advanced-cluster-security/rhacs-scanner-db-rhel8 4.4.8-2, advanced-cluster-security/rhacs-scanner-v4-rhel8 4.4.8-2, +4 more Red Hat RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-collector-rhel8 4.5.6-2, advanced-cluster-security/rhacs-operator-bundle 4.5.6-3, advanced-cluster-security/rhacs-central-db-rhel8 4.5.6-2, advanced-cluster-security/rhacs-scanner-db-rhel8 4.5.6-3, advanced-cluster-security/rhacs-collector-slim-rhel8 4.5.6-2, advanced-cluster-security/rhacs-scanner-db-slim-rhel8 4.5.6-1
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 22 mo ago
Exploit prediction
1.28% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear |
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | gopkg.in/src-d/go-git.v4 | >=4.0.0, <=4.13.1 >=4.0.0 |
no fix listed |
| go | github.com/go-git/go-git/v5 | <5.13.0 |
5.13.0 |
| go | github.com/go-git/go-git/v4 | >=4.0.0 |
no fix listed |
Affected products
- go-git go-git
Classification
- Weakness
-
- CWE-88 Improper Neutralization of Argument Delimiters in a Command
References
-
github.com
/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-21613
advisory
-
github.com
/go-git/go-git
package
Sources
- CVE List CVE-2025-21613
- GitHub Advisory GHSA-v725-9546-7q7m
- NVD CVE-2025-21613
- OSV GO-2025-3368
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.