CVE-2026-33762

package main import ( "fmt" "os" "github.com/go-git/go-git/v5" ) // PoC for CVE-2026-33762 // This code attempts to open a repository containing a crafted Git index file (version 4). // In vulnerable versions (< 5.17.1), parsing the malicious index triggers an out-of-bounds panic. func main() { // Replace with the path to a repository containing the crafted .git/index repoPath := "./crafted_repo" fmt.Printf("Attempting to open repository at: %s\n", repoPath) // PlainOpen triggers the index decoding logic _, err := git.PlainOpen(repoPath) if err != nil { fmt.Printf("Error: %v\n", err) os.Exit(1) } fmt.Println("Repository opened successfully. The library may be patched.") }

{"cve": {"id": "CVE-2026-33762", "sourceIdentifier": "[email protected]", "published": "2026-03-31T15:16:15.597", "lastModified": "2026-04-02T16:49:29.700", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "baseScore": 2.8, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.3, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-129"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:go-git_project:go-git:*:*:*:*:*:go:*:*", "versionEndExcluding": "5.17.1", "matchCriteriaId": "B23FA8A3-7368-4B78-B80A-9BCC2F012738"}]}]}], "references": [{"url": "https://github.com/go-git/go-git/releases/tag/v5.17.1", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}