Most recent entries from all

Withdrawn: CLEANSTART-2026-CB54577 — Security fixes in boring-registry 0.19.0-r1

Withdrawn by the publisher.

Affected: CleanStart: boring-registry

Package boring-registry version 0.19.0-r1 fixes 1 vulnerabilities: CVE-2026-71556

EUVD-2026-349346

fkie_cve-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

GHSA-hc8v-wwc9-vgxm — go-git: Worktree operations may follow symlinks

Affected: Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6

## Impact

A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path.

The `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.

As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`.

A symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration.

Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.

Applications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability.

## Patches

The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.

Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.

Users of filesystem-backed work…

msrc_CVE-2026-71556 — go-git: Worktree operations may follow symlinks

msrc_CVE-2026-71556

openSUSE-SU-2026:11694-1 — amazon-ssm-agent-3.3.5226.0-1.1 on GA media

amazon-ssm-agent-3.3.5226.0-1.1 on GA media

RHSA-2026:50953 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

SUSE-SU-2026:4286-1 — Security update for amazon-ssm-agent

Security update for amazon-ssm-agent

UBUNTU-CVE-2026-71556

Affected: Ubuntu:Pro:22.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:24.04:LTS: golang-github-go-git-go-git, Ubuntu:Pro:26.04:LTS: golang-github-go-git-go-git