CVE-2023-49569 is a critical path traversal flaw, scored 9.8, in go-git before v5.11. It can let an attacker create and amend files across the filesystem and, in the worst case, run code. Only the ChrootOS default is affected. Upgrade to v5.11 or later.
What's affected
The record says go-git versions prior to v5.11 are affected. The GitHub advisory GHSA-449p-3h89-pw88 gives the range as v4.0.0 through v5.11.0, with v5.11 as the patched version. The advisory's wording says prior to v5.11 while the table includes 5.11.0, so use the newest v5 release to be safe.
Applications are only affected if they use the ChrootOS filesystem option, which is the default for the Plain versions of the Open and Clone functions, such as PlainClone. Applications that use BoundOS or in-memory filesystems are not affected. The upstream git client is not affected either. Both the record and the advisory agree on 9.8 Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
List the go-git versions in your module graph.
go list -m all | grep go-git/go-git
Then search your code for the default clone and open functions that the advisory names.
grep -rn "PlainClone\|PlainOpen\|PlainInit" --include=*.go .
A version below v5.11 together with use of the Plain functions is the exposed combination. If you set up a BoundOS filesystem yourself, the advisory says you are not affected.
What to do now
- Find go-git in every Go module, including indirect dependencies, and note versions below v5.11.
- Upgrade to v5.11 or later, then run your tests, because a Git library upgrade can change behaviour.
- Rebuild and redeploy every binary that embeds go-git.
- Until then, restrict cloning to Git servers you trust, which is the advisory's workaround.
- Run services that clone repositories as a low privilege user in a sandbox with a limited filesystem view.
Why it matters
The weakness is path traversal, CWE-22. A path supplied by a remote party is not confined to the intended directory, so files can be created or changed elsewhere. If those files include scripts or configuration that something else runs, the result can be code execution, which is why the advisory says so for the worst case.
This bug is useful to look at through reachability. The package is a dependency in many Go programs, but the flaw only matters when the program uses the default Plain functions on a server you do not control. Knowing which programs do that is the difference between a long list and a short one. KEV status is false for this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I safe if I use an in-memory filesystem?
Per the advisory, yes for this issue. Applications using BoundOS or in-memory filesystems are not affected, but upgrading is still sensible.
Sources
go-git security advisory GHSA-449p-3h89-pw88
Last reviewed: 19 October 2026.
