Hi,

The following vulnerabilities were published for golang-github-go-git-go-git.

CVE-2026-71556[0]:
| go-git is an extensible git implementation library written in pure
| Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations
| (including checkout, status, and add) resolve symbolic links inside
| the working tree without confining resolution to the worktree
| boundary, so a maliciously crafted repository containing a symlink
| can cause go-git to read from or write to files outside the intended
| working directory when the repository is cloned and its worktree
| operations are used. Versions 5.19.2 and 6.0.0-alpha.5.


CVE-2026-71557[1]:
| go-git is an extensible git implementation library written in pure
| Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not
| sanitized before being used to construct on-disk paths under the
| reference storage directory, so a maliciously crafted reference name
| (for example containing directory-traversal sequences) can cause go-
| git to write files outside the intended reference storage directory.
| Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-71556
https://www.cve.org/CVERecord?id=CVE-2026-71556
[1] https://security-tracker.debian.org/tracker/CVE-2026-71557
https://www.cve.org/CVERecord?id=CVE-2026-71557

Regards,
Salvatore