id: GO-2025-3368
modules:
    - module: github.com/go-git/go-git/v5
      versions:
        - fixed: 5.13.0
      vulnerable_at: 5.12.0
    - module: github.com/go-git/go-git/v4
      versions:
        - introduced: 4.0.0
      vulnerable_at: 4.13.1
    - module: gopkg.in/src-d/go-git.v4
      versions:
        - introduced: 4.0.0
      vulnerable_at: 4.13.1
summary: Argument Injection via the URL field in github.com/go-git/go-git
cves:
    - CVE-2025-21613
ghsas:
    - GHSA-v725-9546-7q7m
credits:
    - '@vin01'
references:
    - advisory: https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m
notes:
    - Could not find fix commit; leaving all packages vulnerable.
source:
    id: GHSA-v725-9546-7q7m
    created: 2025-01-06T15:18:10.910983-10:00
review_status: REVIEWED