go-git is a highly extensible git implementation library written in pure Go

CVE-2025-21613 is an argument-injection flaw in go-git before v5.13.0, with the legacy gopkg.in/src-d/go-git.v4 line also affected through 4.13.1. The bug lets attacker-controlled input in the repository URL influence git-upload-pack flags, but only when the application uses the file transport path, because that is the only go-git path that shells out to the system git binary. In plain English: this is not a generic network bug in every app that imports go-git; it is a bug in the subset of apps that accept untrusted repository URLs and then let those URLs resolve to local-file transport on the target host.

The vendor CVSS treats this like broad unauthenticated network compromise, which overstates enterprise risk for most deployments. The decisive friction is environmental: go-git is a library, not an exposed daemon, and exploitation requires both attacker influence over the URL field and an application path that reaches file:// or equivalent local transport behavior. That combination exists in some CI, GitOps, import, and automation workflows, but it is nowhere near internet-wide, and modern allowlisting of URL schemes often kills the path outright.

Why this verdict

• Major friction: requires file transport. The advisory explicitly limits exploitation to the file protocol path, which dramatically cuts the exposed population versus a true network-reachable parser or service bug.
• It is a library, not a daemon. Attackers cannot scan the internet for go-git; they need a separate vulnerable application that embeds it and accepts attacker-controlled repository URLs.
• Attacker position is narrower than CVSS implies. In practice this often means authenticated or workflow-level influence over a repo-import field, CI job parameter, or internal automation input, which is post-initial-access or at least post-reachability in many enterprises.
• Modern controls often stop it early. URL-scheme allowlisting, denying file://, ephemeral runners, and omission of the git CLI in containers all break the chain before impact.
• Threat intel is quiet. No KEV listing, no active exploitation evidence in reviewed primary sources, and the supplied EPSS is not screaming emergency.

Why not higher?

The attack chain has two compounding gates: the vulnerable dependency must exist, and the embedding application must permit attacker-influenced file transport. That is a much narrower and less internet-scalable path than the vendor's unauthenticated network-critical framing. There is also no reviewed evidence of active exploitation to justify keeping this in a top emergency bucket.

Why not lower?

This is still a real security flaw in a popular Git automation library, not a theoretical lint issue. If your estate includes self-service repo imports, GitOps controllers, CI utilities, or developer platforms that pass low-trust URLs into go-git, the exploit preconditions can be satisfied surprisingly easily. In those environments, compromise of a runner or access to sensitive local repositories can become meaningful business impact.

1. Block file:// and local-path repository URLs — Enforce URL-scheme allowlisting in every application path that accepts repository locations, permitting only approved schemes like https:// and ssh://. For a MEDIUM verdict there is noisgate no mitigation SLA — go straight to the 365-day remediation window, but if the app is internet-facing or multi-tenant, do this control change immediately because it kills the exact vulnerable path.
2. Remove the system git binary from unneeded runtimes — This CVE only bites on the shell-out path, so minimal containers and app runtimes that do not require CLI git should not ship it. That is a high-leverage containment step for runners and service containers and can usually be folded into the next base-image refresh even though there is no formal mitigation SLA for this severity.
3. Constrain repository operations to an allowlisted workspace — Run git workflows under dedicated service accounts with restricted filesystem access and ephemeral work directories. That limits what a successful exploit can read or disrupt and should be part of your normal hardening before the 365-day remediation window closes.
4. Hunt for vulnerable modules in SBOMs and lockfiles — Query go.mod, go.sum, vendored modules, container SBOMs, and build images for github.com/go-git/go-git/v5 versions below 5.13.0 and gopkg.in/src-d/go-git.v4 through 4.13.1. Because this is a library issue, asset inventory matters more than perimeter scanning.
5. Watch for anomalous child git executions — Add EDR or audit rules for service processes and CI runners spawning git-upload-pack with unexpected arguments. This does not prevent exploitation, but it gives you a practical tripwire on the narrow path where the bug becomes real.

Run this on a developer workstation, CI workspace, source repository root, or extracted SBOM/asset directory that contains go.mod, go.sum, or vendor/modules.txt. Invoke it as python3 check_cve_2025_21613.py /path/to/project; no admin privileges are required. It reports VULNERABLE if it finds github.com/go-git/go-git/v5 below 5.13.0 or gopkg.in/src-d/go-git.v4 at or below 4.13.1, PATCHED if it finds only fixed versions, and UNKNOWN if it cannot determine usage.

#!/usr/bin/env python3
# check_cve_2025_21613.py
# Defensive dependency check for CVE-2025-21613 in go-git
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

import os
import re
import sys
from typing import List, Optional, Tuple

TARGETS = {
    'github.com/go-git/go-git/v5': ('5.13.0', 'lt'),
    'gopkg.in/src-d/go-git.v4': ('4.13.1', 'le'),
}

SEMVER_RE = re.compile(r'v?(\d+)\.(\d+)\.(\d+)')
REQ_RE = re.compile(r'^\s*require\s+([^\s]+)\s+(v?[^\s]+)')
REQ_BLOCK_RE = re.compile(r'^\s*([^\s]+)\s+(v?[^\s]+)')
MODLINE_RE = re.compile(r'^#\s+([^\s]+)\s+(v?[^\s]+)')

def parse_semver(v: str) -> Optional[Tuple[int, int, int]]:
    m = SEMVER_RE.search(v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())

def cmp_ver(a: str, b: str) -> Optional[int]:
    pa = parse_semver(a)
    pb = parse_semver(b)
    if pa is None or pb is None:
        return None
    return (pa > pb) - (pa < pb)

def is_vulnerable(module: str, version: str) -> Optional[bool]:
    fixed, op = TARGETS[module]
    c = cmp_ver(version, fixed)
    if c is None:
        return None
    if op == 'lt':
        return c < 0
    if op == 'le':
        return c <= 0
    return None

def collect_from_go_mod(path: str) -> List[Tuple[str, str, str]]:
    results = []
    if not os.path.isfile(path):
        return results
    in_block = False
    with open(path, 'r', encoding='utf-8', errors='ignore') as f:
        for line in f:
            s = line.strip()
            if s.startswith('require ('):
                in_block = True
                continue
            if in_block and s == ')':
                in_block = False
                continue
            m = REQ_RE.match(line)
            if m:
                mod, ver = m.groups()
                if mod in TARGETS:
                    results.append((mod, ver, path))
                continue
            if in_block:
                m = REQ_BLOCK_RE.match(line)
                if m:
                    mod, ver = m.groups()
                    if mod in TARGETS:
                        results.append((mod, ver, path))
    return results

def collect_from_vendor_modules(path: str) -> List[Tuple[str, str, str]]:
    results = []
    if not os.path.isfile(path):
        return results
    with open(path, 'r', encoding='utf-8', errors='ignore') as f:
        for line in f:
            m = MODLINE_RE.match(line)
            if not m:
                continue
            mod, ver = m.groups()
            if mod in TARGETS:
                results.append((mod, ver, path))
    return results

def collect_from_go_sum(path: str) -> List[Tuple[str, str, str]]:
    results = []
    if not os.path.isfile(path):
        return results
    with open(path, 'r', encoding='utf-8', errors='ignore') as f:
        for line in f:
            parts = line.strip().split()
            if len(parts) < 2:
                continue
            mod, ver = parts[0], parts[1]
            if mod in TARGETS:
                ver = ver.split('/go.mod')[0]
                results.append((mod, ver, path))
    return results

def main() -> int:
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2025_21613.py /path/to/project')
        return 3

    root = sys.argv[1]
    if not os.path.exists(root):
        print(f'UNKNOWN - path not found: {root}')
        return 3

    findings: List[Tuple[str, str, str]] = []
    for base, dirs, files in os.walk(root):
        if '.git' in dirs:
            dirs.remove('.git')
        if 'node_modules' in dirs:
            dirs.remove('node_modules')
        if 'vendor' in dirs and 'modules.txt' not in files:
            pass
        if 'go.mod' in files:
            findings.extend(collect_from_go_mod(os.path.join(base, 'go.mod')))
        if 'go.sum' in files:
            findings.extend(collect_from_go_sum(os.path.join(base, 'go.sum')))
        if 'modules.txt' in files and os.path.basename(base) == 'vendor':
            findings.extend(collect_from_vendor_modules(os.path.join(base, 'modules.txt')))

    if not findings:
        print('UNKNOWN - no matching go-git modules found in go.mod, go.sum, or vendor/modules.txt')
        return 2

    vulnerable = []
    patched = []
    undetermined = []

    seen = set()
    for mod, ver, src in findings:
        key = (mod, ver, src)
        if key in seen:
            continue
        seen.add(key)
        verdict = is_vulnerable(mod, ver)
        entry = f'{mod} {ver} ({src})'
        if verdict is True:
            vulnerable.append(entry)
        elif verdict is False:
            patched.append(entry)
        else:
            undetermined.append(entry)

    if vulnerable:
        print('VULNERABLE - ' + '; '.join(vulnerable))
        return 1
    if patched and not undetermined:
        print('PATCHED - ' + '; '.join(patched))
        return 0

    detail = []
    if patched:
        detail.append('patched=' + ', '.join(patched))
    if undetermined:
        detail.append('undetermined=' + ', '.join(undetermined))
    print('UNKNOWN - ' + '; '.join(detail))
    return 2

if __name__ == '__main__':
    sys.exit(main())

Sources

1. GitHub Advisory GHSA-v725-9546-7q7m
2. NVD CVE-2025-21613
3. CVE Record
4. go-git releases
5. Ubuntu CVE tracker
6. Debian security tracker
7. CISA KEV catalog
8. FIRST EPSS documentation