gopkg.in/src-d/go-git.v4 has critical vulnerabilities — do not use
Update to >= 5.13.0 to fix known vulnerabilities
| Severity | ID | Summary | Fixed in |
|---|---|---|---|
| critical | CVE-2023-49569 | Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients | 5.11.0 |
| high | CVE-2023-49568 | Maliciously crafted Git server replies can cause DoS on go-git clients | 5.11.0 |
| high | CVE-2025-21614 | go-git clients vulnerable to DoS via maliciously crafted Git server replies | 5.13.0 |
| critical | CVE-2025-21613 | go-git has an Argument Injection via the URL field | 5.13.0 |
| unknown | CVE-2023-49569 | Path traversal and RCE in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4 | 5.11.0 |
| unknown | CVE-2023-49568 | Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4 | 5.11.0 |
| unknown | CVE-2025-21614 | Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git | 5.13.0 |
| unknown | CVE-2025-21613 | Argument Injection via the URL field in github.com/go-git/go-git | 5.13.0 |
Get this data programmatically — free, no authentication.
curl https://depscope.dev/api/check/go/gopkg.in/src-d/go-git.v4Last updated · 2019-08-01T15:22:48Z