CVE-2025-21613: go-git has an Argument Injection via the URL field

Analyzed

AliasesSUSE-SU-2025:0191-1SUSE-SU-2025:0277-1UBUNTU-CVE-2025-21613+328 more

Published 06-01-2025Last modified 06-01-2025

Vulnerability summary

CVE-2025-21613 is a critical (CVSS 9.8) vulnerability in go-git_project go-git. EPSS estimates a 1.28% chance of exploitation in the next 30 days, higher than 70% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

1.28%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 81

OPENSUSE-SU-2025:0056-1 OPENSUSE-SU-2025:14624-1 OPENSUSE-SU-2025:14713-1 OPENSUSE-SU-2025:14902-1 OPENSUSE-SU-2025:15487-1 OPENSUSE-SU-2025:20117-1+75 more

Timeline

06-01-2025
PublishedVulnerability first disclosed.
06-01-2025
Last modifiedVulnerability information updated.

Description

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

CVSS metrics

11 scores · 7 sources · 2 versions

v4.09.2v3.19.8

EPSS trend

Probability

1.28%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 1.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-88Improper Neutralization of Argument Delimiters in a CommandThe product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard161 products

amazon-ssm-agent< 3.3.1957.0-r5
amazon-ssm-agent-ecs-exec< 3.3.1957.0-r5
apko< 0.22.5-r0
argo-cd-2.11< 2.11.12-r3
argo-cd-2.13< 2.13.3-r1

argo-cd-2.13-compat< 2.13.3-r1
argo-cd-2.13-repo-server< 2.13.3-r1
argo-events< 1.9.3-r3
argo-events-fips< 1.9.3-r3
argo-workflows< 3.6.2-r4
argo-workflows-fips< 3.6.2-r3
argocd-image-updater< 0.15.2-r1
argocd-image-updater-compat< 0.15.2-r1
argocd-image-updater-fips< 0.15.2-r0
bom< 0.6.0-r14
chainctl< 0.2.20-r0
chezmoi< 2.57.0-r1
crossplane-crank< 1.18.2-r2
dagger< 0.15.1-r3
docker-credential-cgr< 0.2.20-r0
flux< 2.4.0-r3
flux-fips-2.4< 2.4.0-r3
flux-fips-2.4-compat< 2.4.0-r3
flux-image-automation-controller< 0.39.0-r5
flux-image-automation-controller-compat< 0.39.0-r5
flux-image-automation-controller-fips< 0.39.0-r3
flux-image-automation-controller-fips-compat< 0.39.0-r3
flux-image-automation-controller-iamguarded-compat< 0.39.0-r5
flux-kustomize-controller< 1.4.0-r4
flux-kustomize-controller-fips< 1.4.0-r3
flux-kustomize-controller-iamguarded-compat< 1.4.0-r4
flux-source-controller< 1.4.1-r6
flux-source-controller-fips< 1.4.1-r4
flux-source-controller-iamguarded-compat< 1.4.1-r6
gitea< 1.22.6-r2
gitea-compat< 1.22.6-r2
gitea-fips< 1.22.6-r2
gitea-fips-compat< 1.22.6-r2
gitsign< 0.12.0-r1
gitsign-config< 0.12.0-r1
gitsign-credential-cache< 0.12.0-r1
go-licenses< 1.6.0-r20
goreleaser< 2.5.1-r1
gptscript< 0.9.5-r4
grafana-alloy< 1.5.1-r3
grafana-alloy-fips< 1.5.1-r3
grype< 0.86.1-r2
guac< 0.12.4-r1
guaccsub< 0.12.4-r1
guacgql< 0.12.4-r1
guacingest< 0.12.4-r1
guacone< 0.12.4-r1
k8sgpt< 0.3.48-r3
k9s< 0.32.7-r3
kaniko< 1.23.2-r8
kaniko-compat< 1.23.2-r8
kaniko-fips< 1.23.2-r4
kaniko-warmer< 1.23.2-r8
kaniko-warmer-compat< 1.23.2-r8
kaniko-warmer-fips< 1.23.2-r4
kargo< 1.1.2-r1
kargo-oci-compat< 1.1.2-r1
kots< 1.123.0-r1
kots-compat< 1.123.0-r1
kots-symlink-compat< 1.123.0-r1
kubescape< 3.0.22-r3
kubevela< 1.9.13-r6
kubevela-vela-cli< 1.9.13-r6
kubevela-vela-core< 1.9.13-r6
kubevela-vela-core-compat< 1.9.13-r6
kyverno-1.13< 1.13.2-r3
kyverno-background-controller-1.13< 1.13.2-r3
kyverno-background-controller-fips-1.13< 1.13.2-r3
kyverno-cleanup-controller-1.13< 1.13.2-r3
kyverno-cleanup-controller-fips-1.13< 1.13.2-r3
kyverno-cli-1.13< 1.13.2-r3
kyverno-cli-fips-1.13< 1.13.2-r3
kyverno-fips-1.13< 1.13.2-r3
kyverno-init-container-1.13< 1.13.2-r3
kyverno-init-container-fips-1.13< 1.13.2-r3
kyverno-reports-controller-1.13< 1.13.2-r3
kyverno-reports-controller-fips-1.13< 1.13.2-r3
melange< 0.18.3-r1
nemo< 1.23.0-r7
nuclei< 3.3.7-r3
osv-scanner< 1.9.2-r1
packer< 1.11.2-r3
packer-fips< 1.11.2-r3
pulumi< 3.145.0-r0
pulumi-kubernetes-operator< 1.16.0-r6
pulumi-language-dotnet< 3.71.1-r2
pulumi-language-go< 3.145.0-r0
pulumi-language-java< 1.6.0-r1
pulumi-language-nodejs< 3.145.0-r0
pulumi-language-python< 3.145.0-r0
pulumi-language-yaml< 1.13.0-r3
scorecard< 5.0.0-r5
skaffold< 2.13.2-r5
snyk-cli< 1.1294.3-r2
src-fingerprint< 0.19.0-r21
src-fingerprint-fips< 0.19.0-r7
syft< 1.18.1-r2
task< 3.40.1-r3
tekton-pipelines-0.59< 0.59.6-r2
tekton-pipelines-0.62< 0.62.9-r2
tekton-pipelines-0.65< 0.65.7-r2
tekton-pipelines-controller-0.59< 0.59.6-r2
tekton-pipelines-controller-0.59-compat< 0.59.6-r2
tekton-pipelines-controller-0.62< 0.62.9-r2
tekton-pipelines-controller-0.62-compat< 0.62.9-r2
tekton-pipelines-controller-0.65< 0.65.7-r2
tekton-pipelines-controller-0.65-compat< 0.65.7-r2
tekton-pipelines-entrypoint-0.59< 0.59.6-r2
tekton-pipelines-entrypoint-0.59-compat< 0.59.6-r2
tekton-pipelines-entrypoint-0.62< 0.62.9-r2
tekton-pipelines-entrypoint-0.62-compat< 0.62.9-r2
tekton-pipelines-entrypoint-0.65< 0.65.7-r2
tekton-pipelines-entrypoint-0.65-compat< 0.65.7-r2
tekton-pipelines-events-0.59< 0.59.6-r2
tekton-pipelines-events-0.59-compat< 0.59.6-r2
tekton-pipelines-events-0.62< 0.62.9-r2
tekton-pipelines-events-0.62-compat< 0.62.9-r2
tekton-pipelines-events-0.65< 0.65.7-r2
tekton-pipelines-events-0.65-compat< 0.65.7-r2
tekton-pipelines-nop-0.59< 0.59.6-r2
tekton-pipelines-nop-0.59-compat< 0.59.6-r2
tekton-pipelines-nop-0.62< 0.62.9-r2
tekton-pipelines-nop-0.62-compat< 0.62.9-r2
tekton-pipelines-nop-0.65< 0.65.7-r2
tekton-pipelines-nop-0.65-compat< 0.65.7-r2
tekton-pipelines-resolvers-0.59< 0.59.6-r2
tekton-pipelines-resolvers-0.59-compat< 0.59.6-r2
tekton-pipelines-resolvers-0.62< 0.62.9-r2
tekton-pipelines-resolvers-0.62-compat< 0.62.9-r2
tekton-pipelines-resolvers-0.65< 0.65.7-r2
tekton-pipelines-resolvers-0.65-compat< 0.65.7-r2
tekton-pipelines-sidecarlogresults-0.59< 0.59.6-r2
tekton-pipelines-sidecarlogresults-0.59-compat< 0.59.6-r2
tekton-pipelines-sidecarlogresults-0.62< 0.62.9-r2
tekton-pipelines-sidecarlogresults-0.62-compat< 0.62.9-r2
tekton-pipelines-sidecarlogresults-0.65< 0.65.7-r2
tekton-pipelines-sidecarlogresults-0.65-compat< 0.65.7-r2
tekton-pipelines-webhook-0.59< 0.59.6-r2
tekton-pipelines-webhook-0.59-compat< 0.59.6-r2
tekton-pipelines-webhook-0.62< 0.62.9-r2
tekton-pipelines-webhook-0.62-compat< 0.62.9-r2
tekton-pipelines-webhook-0.65< 0.65.7-r2
tekton-pipelines-webhook-0.65-compat< 0.65.7-r2
tekton-pipelines-workingdirinit-0.59< 0.59.6-r2
tekton-pipelines-workingdirinit-0.59-compat< 0.59.6-r2
tekton-pipelines-workingdirinit-0.62< 0.62.9-r2
tekton-pipelines-workingdirinit-0.62-compat< 0.62.9-r2
tekton-pipelines-workingdirinit-0.65< 0.65.7-r2
tekton-pipelines-workingdirinit-0.65-compat< 0.65.7-r2
tfsec< 1.28.12-r1
timoni< 0.23.0-r3
trivy< 0.58.1-r1
trivy-fips< 0.58.2-r0
wolfictl< 0.27.5-r0
zarf< 0.45.0-r3
zot< 2.1.1-r8

Show all 161

Wolfi39 products

apko< 0.22.5-r0
argo-events< 1.9.3-r3
argo-workflows< 3.6.2-r4
argocd-image-updater< 0.15.2-r1
argocd-image-updater-compat< 0.15.2-r1

Show all 39

2 vendors · 200 products · Showing 200 of 249

References

15 links

github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7mX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
www.suse.com/support/update/announcement/2025/suse-su-20250191-1/Advisory
bugzilla.suse.com/1235575REPORT
www.suse.com/security/cve/CVE-2025-21613WEB
www.suse.com/support/update/announcement/2025/suse-su-20250277-1/Advisory
ubuntu.com/security/CVE-2025-21613REPORT
www.cve.org/CVERecord?id=CVE-2025-21613REPORT
ubuntu.com/security/notices/USN-8088-1Advisory
security-tracker.debian.org/tracker/CVE-2025-21613Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21613.jsonAdvisory

Show all 15 references

nvd.nist.gov/vuln/detail/CVE-2025-21613AdvisoryOval
github.com/go-git/go-gitPACKAGE
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory