The go-git library contains a path traversal vulnerability that could allow attackers to bypass file access restrictions and interact with unintended files on the host system.

This is an improper link resolution vulnerability (CWE-59) where the library fails to properly validate symbolic links, allowing an attacker to access files outside of the intended directory structure.

The exploitation of this vulnerability could lead to unauthorized information disclosure or modification of sensitive files on systems utilizing the go-git library. With a CVSS score of 7.1, this issue represents a significant risk for development environments and CI/CD pipelines that rely on this library for automated repository processing.

Immediate Action: Update the go-git library to version 5.19.2 or 6.0.0-alpha.5 depending on the branch in use.

Proactive Monitoring: Review application access logs for attempts to access files outside of expected git repository boundaries or unusual path traversal patterns.

Compensating Controls: Ensure that applications using go-git are running with the principle of least privilege, specifically restricting file system access to only the necessary directories required for repository operations.

Public Exploit Available: No (exploit_available: false).

The vulnerability is well-defined and a patch is readily available. Developers and system administrators should prioritize updating the go-git dependency in all affected projects immediately to prevent potential file system manipulation.