Skip to main content

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CVE-2025-21613

High
9.2/10

Summary

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git affected versions. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to `git-upload-pack` flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to `git` binaries. This issue affects gopkg.in/src-d/go-git.v4 package versions 4.0-RC1 through 4.13.1 and github.com/go-git/go-git/v5 4.0.0-rc1 through 5.12.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References

Advisory Timeline

  • Published