CVE-2025-21613: Go-git RCE Vulnerability

CVE-2025-21613 Overview

CVE-2025-21613 is a critical argument injection vulnerability discovered in go-git, a highly extensible Git implementation library written in pure Go. This vulnerability allows attackers to set arbitrary values to git-upload-pack flags when the file transport protocol is used, as this is the only protocol that shells out to Git binaries.

Critical Impact

Successful exploitation could allow attackers to inject arbitrary arguments into git-upload-pack commands, potentially leading to remote code execution or unauthorized repository access.

Affected Products

• go-git versions prior to 5.13.0
• Applications utilizing go-git with file transport protocol
• Go-based Git clients and services leveraging the vulnerable library

Discovery Timeline

• 2025-01-06 - CVE-2025-21613 published to NVD
• 2025-04-17 - Last updated in NVD database

Technical Details for CVE-2025-21613

Vulnerability Analysis

This vulnerability falls under CWE-88 (Improper Neutralization of Argument Delimiters in a Command), commonly known as argument injection. The flaw exists in how go-git handles user-supplied input when constructing command-line arguments for the git-upload-pack binary.

When go-git uses the file transport protocol to interact with Git repositories, it spawns external Git processes. The vulnerability arises because user-controlled input is not properly sanitized before being passed as arguments to these processes. An attacker can craft malicious input containing argument delimiters that, when processed, inject additional flags into the git-upload-pack command execution.

The file transport protocol is specifically affected because it's the only transport mechanism in go-git that executes external Git binaries. Other transport protocols (HTTP, SSH) handle Git operations internally without shelling out to external commands.

Root Cause

The root cause is insufficient input validation and sanitization when constructing command-line arguments for external Git binary execution. The go-git library fails to properly escape or validate parameters before passing them to the shell, allowing specially crafted input to be interpreted as additional command-line arguments rather than data.

Attack Vector

The attack vector is network-based, requiring no user interaction or prior authentication. An attacker can exploit this vulnerability remotely by providing malicious input to applications using go-git's file transport protocol. The attack involves crafting repository URLs or references that contain embedded argument delimiters, causing the git-upload-pack command to receive attacker-controlled flags.

The exploitation path typically involves:

1. Identifying an application using go-git with file transport enabled
2. Crafting malicious input containing argument injection payloads
3. Triggering a Git operation that causes go-git to shell out to git-upload-pack
4. The injected arguments are executed with the privileges of the go-git process

For detailed technical analysis and proof-of-concept information, see the GitHub Security Advisory.

Detection Methods for CVE-2025-21613

Indicators of Compromise

• Unusual command-line arguments in process logs for git-upload-pack executions
• Unexpected Git operations or repository access patterns
• Process execution logs showing injected flags in Git commands
• Application logs indicating file transport protocol usage with suspicious inputs

Detection Strategies

• Monitor process creation events for git-upload-pack with unusual or unexpected command-line arguments
• Implement application-level logging for all Git operations using file transport protocol
• Deploy endpoint detection rules to identify argument injection patterns in Git command executions
• Audit go-git library versions in deployed applications and flag versions prior to 5.13.0

Monitoring Recommendations

• Enable detailed logging for applications utilizing go-git library
• Configure alerting for anomalous Git process executions with non-standard flags
• Implement file integrity monitoring on Git binaries and related configuration files
• Review and audit all input sources that could influence Git repository URLs or references

How to Mitigate CVE-2025-21613

Immediate Actions Required

• Upgrade go-git to version 5.13.0 or later immediately
• Audit all applications in your environment that depend on go-git library
• If upgrading is not immediately possible, disable file transport protocol usage where feasible
• Review application code for user-controlled input that flows into Git operations

Patch Information

The vulnerability is fixed in go-git version 5.13.0. Organizations should update their Go module dependencies to include the patched version. The fix addresses the argument injection by properly sanitizing and validating input before constructing command-line arguments for external Git processes.

For complete patch details and security guidance, refer to the GitHub Security Advisory GHSA-v725-9546-7q7m.

Workarounds

• Disable file transport protocol and use alternative transport mechanisms (HTTP, SSH) where possible
• Implement strict input validation at the application layer before passing data to go-git
• Deploy network segmentation to limit exposure of vulnerable applications
• Apply principle of least privilege to processes running go-git operations

# Update go-git dependency to patched version
go get github.com/go-git/go-git/v5@v5.13.0

# Verify the updated version
go list -m github.com/go-git/go-git/v5