go-git is a highly extensible git implementation library written in pure Go

#!/usr/bin/env python3
# check_cve_2025_21614.py
# Detect vulnerable go-git module versions in a Go source tree.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import os
import re
import sys
from typing import Optional, Tuple, List

VULN_MODULES = {
    'github.com/go-git/go-git/v5': ('v5', '5.13.0'),
    'github.com/go-git/go-git/v4': ('v4', None),
    'gopkg.in/src-d/go-git.v4': ('v4', None),
}

SEMVER_RE = re.compile(r'v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$')
REQ_RE = re.compile(r'^\s*(require|replace)\s+([^\s]+)\s+v?([^\s]+)')
MODTXT_RE = re.compile(r'^#\s+([^\s]+)\s+v?([^\s]+)')
GOSUM_RE = re.compile(r'^([^\s]+)\s+v?([^\s]+)')


def normalize_version(v: str) -> Optional[str]:
    v = v.strip()
    if v.endswith('/go.mod'):
        v = v[:-7]
    if not v.startswith('v'):
        v = 'v' + v
    if SEMVER_RE.match(v):
        return v
    return None


def semver_tuple(v: str) -> Optional[Tuple[int, int, int]]:
    m = SEMVER_RE.match(v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def lt(v1: str, v2: str) -> Optional[bool]:
    t1 = semver_tuple(v1)
    t2 = semver_tuple(v2)
    if t1 is None or t2 is None:
        return None
    return t1 < t2


def assess(module: str, version: str) -> Tuple[str, str]:
    nv = normalize_version(version)
    if module not in VULN_MODULES:
        return ('UNKNOWN', f'{module} {version} not in target set')
    branch, fixed = VULN_MODULES[module]
    if branch == 'v4':
        return ('VULNERABLE', f'{module} {version} is on vulnerable v4 line with no known fixed release')
    if nv is None:
        return ('UNKNOWN', f'{module} {version} could not be parsed')
    cmp = lt(nv, 'v' + fixed if not fixed.startswith('v') else fixed)
    if cmp is None:
        return ('UNKNOWN', f'{module} {version} could not be compared')
    if cmp:
        return ('VULNERABLE', f'{module} {nv} < v5.13.0')
    return ('PATCHED', f'{module} {nv} >= v5.13.0')


def parse_go_mod(path: str) -> List[Tuple[str, str, str]]:
    findings = []
    if not os.path.isfile(path):
        return findings
    with open(path, 'r', encoding='utf-8', errors='ignore') as f:
        for line in f:
            m = REQ_RE.match(line)
            if m:
                module = m.group(2)
                version = m.group(3)
                if module in VULN_MODULES:
                    findings.append(('go.mod', module, version))
    return findings


def parse_go_sum(path: str) -> List[Tuple[str, str, str]]:
    findings = []
    if not os.path.isfile(path):
        return findings
    with open(path, 'r', encoding='utf-8', errors='ignore') as f:
        for line in f:
            m = GOSUM_RE.match(line)
            if m:
                module = m.group(1)
                version = m.group(2)
                if module in VULN_MODULES:
                    findings.append(('go.sum', module, version))
    return findings


def parse_vendor_modules(path: str) -> List[Tuple[str, str, str]]:
    findings = []
    if not os.path.isfile(path):
        return findings
    with open(path, 'r', encoding='utf-8', errors='ignore') as f:
        for line in f:
            m = MODTXT_RE.match(line)
            if m:
                module = m.group(1)
                version = m.group(2)
                if module in VULN_MODULES:
                    findings.append(('vendor/modules.txt', module, version))
    return findings


def main() -> int:
    if len(sys.argv) != 2:
        print('UNKNOWN: usage: python3 check_cve_2025_21614.py /path/to/repo')
        return 3

    root = sys.argv[1]
    if not os.path.isdir(root):
        print(f'UNKNOWN: path not found: {root}')
        return 3

    findings = []
    findings.extend(parse_go_mod(os.path.join(root, 'go.mod')))
    findings.extend(parse_go_sum(os.path.join(root, 'go.sum')))
    findings.extend(parse_vendor_modules(os.path.join(root, 'vendor', 'modules.txt')))

    if not findings:
        print('UNKNOWN: no target go-git modules found in go.mod, go.sum, or vendor/modules.txt')
        return 2

    verdicts = []
    for source, module, version in findings:
        status, detail = assess(module, version)
        verdicts.append((status, f'[{source}] {detail}'))

    vulnerable = [d for s, d in verdicts if s == 'VULNERABLE']
    patched = [d for s, d in verdicts if s == 'PATCHED']
    unknown = [d for s, d in verdicts if s == 'UNKNOWN']

    if vulnerable:
        print('VULNERABLE: ' + ' | '.join(vulnerable))
        return 1
    if patched and not unknown:
        print('PATCHED: ' + ' | '.join(patched))
        return 0
    print('UNKNOWN: ' + ' | '.join([d for _, d in verdicts]))
    return 2


if __name__ == '__main__':
    sys.exit(main())