CVE-2025-21613

CVE-2025-21613 is a critical argument injection vulnerability in go-git versions prior to 5.13, a pure Go git implementation library. This flaw allows attackers to set arbitrary git-upload-pack flags, but only when the file transport protocol is in use, as this is the sole protocol that shells out to git binaries. With a CVSS score of 9.8 (CRITICAL), successful exploitation could lead to complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, nor are public exploit tools like Metasploit or Nuclei available, though it has garnered some community discussion.