https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:59:39.284916+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-cb54577 Withdrawn: CLEANSTART-2026-CB54577 — Security fixes in boring-registry 0.19.0-r1 2026-10-03T18:59:39.664803+00:00

Withdrawn by the publisher.

Affected: CleanStart: boring-registry

Package boring-registry version 0.19.0-r1 fixes 1 vulnerabilities: CVE-2026-71556

 https://cve.radiocsirt.org/vuln/euvd-2026-349346 EUVD-2026-349346 2026-10-03T18:59:39.664884+00:00 EUVD-2026-349346 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71556 fkie_cve-2026-71556 2026-10-03T18:59:39.664901+00:00

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

 https://cve.radiocsirt.org/vuln/ghsa-hc8v-wwc9-vgxm GHSA-hc8v-wwc9-vgxm — go-git: Worktree operations may follow symlinks 2026-10-03T18:59:39.664936+00:00

Affected: Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6

## Impact

A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path.

The `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.

As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`.

A symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration.

Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.

Applications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability.

## Patches

The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.

Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.

Users of filesystem-backed work…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-71556 msrc_CVE-2026-71556 — go-git: Worktree operations may follow symlinks 2026-10-03T18:59:39.664981+00:00 msrc_CVE-2026-71556 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11694-1 openSUSE-SU-2026:11694-1 — amazon-ssm-agent-3.3.5226.0-1.1 on GA media 2026-10-03T18:59:39.664999+00:00

amazon-ssm-agent-3.3.5226.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:50953 RHSA-2026:50953 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T18:59:39.665017+00:00

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

 https://cve.radiocsirt.org/vuln/suse-su-2026:4286-1 SUSE-SU-2026:4286-1 — Security update for amazon-ssm-agent 2026-10-03T18:59:39.665034+00:00

Security update for amazon-ssm-agent

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-71556 UBUNTU-CVE-2026-71556 2026-10-03T18:59:39.665052+00:00

Affected: Ubuntu:Pro:22.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:24.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:26.04:LTS: golang-github-go-git-go-git

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.