BlackTreeCVE Intelligence
← Back to the CVE catalogue
Full vulnerability report · 2025
CVE-2025-21613High confidence

go-git has an Argument Injection via the URL field

go-git · go-git

Official source article: GitHub GHSA-V725-9546-7Q7M ↗. Check the applicable product and release in the original source.

9.2CriticalCVSS 4.0
Recommended action
Patch only the product branches with a verified fix

Critical technical impact with a remotely reachable, unauthenticated path; no CISA KEV confirmation is currently recorded. Verified remediation exists for at least one product or source, but 1 structured product or package state remain unresolved. Apply remediation only to the exact product branch confirmed by its source.

Fix availability varies by product
R
Operational reassessment

Published severity in operational context

Open reassessment dashboard →
Published severityCriticalOperational priority:Critical, unchanged from published severity.unchanged

Evidence used

  • No CISA KEV confirmation is currently recorded.
  • The selected CVSS metric records a network-reachable, unauthenticated path with no user interaction.
  • EPSS is 1.29% for the current model date.

Compensating controls

  • Validate the affected product branch and deploy the verified fixed release.
  • Restrict the affected network interface to trusted sources where business-safe.
  • Monitor vendor guidance and exploitation sources for a material change.

Verification

  1. Confirm that the asset runs go-git go-git and falls inside the recorded affected range.
  2. Verify the installed build against the product-specific fixed version after deployment.
  3. Validate exposure, authentication requirements and compensating controls in the actual environment.
  4. Reopen this reassessment when CVSS, KEV, EPSS, exploit evidence or remediation changes.
Mitigation target: Within 3 daysRemediation target: Within 90 days

This automated reassessment organises public evidence. It does not know asset exposure, business impact or control effectiveness and does not replace CVSS or a human risk decision.

Cross-source reconciliation

Remediation availability differs by product scope

Verified remediation exists for at least one product or source, but 1 structured product or package state remain unresolved. Apply remediation only to the exact product branch confirmed by its source.

Distribution package intelligence

Release-specific package status

Debian, ubuntu findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.

5 package states
Package result overrides the generic status

BlackTree has verified remediation for at least one product or source, but the relevant distribution still reports no fixed package for 1 affected package state shown here. Treat those rows as affected with no fix until that distribution publishes a fixed version.

Repository candidate not checked

A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.

Distribution releaseSource packageVendor stateFixed versionEvidence
Debian trixietrixie · sourcegolang-github-go-git-go-gitVendor fix publishedDebian records a fixed source-package version for this release.5.13.2-1Debian Security Tracker ↗Source updated 5 Oct 2026
Debian bookwormbookworm · sourcegolang-github-go-git-go-gitAffected, no fix publishedDebian currently tracks this release as open.Not published in this feedDebian Security Tracker ↗Source updated 5 Oct 2026
Debian forkyforky · sourcegolang-github-go-git-go-gitVendor fix publishedDebian records a fixed source-package version for this release.5.13.2-1Debian Security Tracker ↗Source updated 5 Oct 2026
Debian sidsid · sourcegolang-github-go-git-go-gitVendor fix publishedDebian records a fixed source-package version for this release.5.13.2-1Debian Security Tracker ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · esm-appsgolang-github-go-git-go-gitVendor fix publishedCanonical reports that a fixed source package version has been published. Repository candidate availability is not checked by BlackTree.5.4.2-4ubuntu0.24.04.3+esm2Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Open-source package ranges4 source-attributed ranges

These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.

Ecosystem and packageAffected rangeFirst fixed versionEvidence
Gogithub.com/go-git/go-git/v5SEMVER: introduced 0; fixed 5.13.05.13.0OSV record ↗aggregator derived · 10 Sep 2026
Gogopkg.in/src-d/go-git.v4SEMVER: introduced 4.0.0; last affected 4.13.1Not statedOSV record ↗aggregator derived · 10 Sep 2026
gogithub.com/go-git/go-git/v5< 5.13.05.13.0GitHub advisory ↗upstream repository advisory · 6 Jan 2025
gogopkg.in/src-d/go-git.v4>= 4.0.0, <= 4.13.1Not statedGitHub advisory ↗upstream repository advisory · 6 Jan 2025
Direct vendor intelligence

Authoritative vendor CSAF and VEX advisories

Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.

1 current
CVE-2025-21613 · CSAF 2.0 · revision 3 · finalRed Hat Product Securitygo-git: argument injection via the URL field
16 known affected

The vendor explicitly identifies these products as affected by this CVE.

  • openshift-builds/openshift-builds-image-bundler-rhel9.src as a component of Builds for Red Hat OpenShift
  • odo.src as a component of OpenShift Developer Tools and Services
  • openshift-serverless-1-func-utils-rhel8-container as a component of OpenShift Serverless
  • openshift-serverless-1/client-kn-rhel8 as a component of OpenShift Serverless
  • openshift-serverless-1/kn-cli-artifacts-rhel8 as a component of OpenShift Serverless
  • rhacm2/multicluster-operators-subscription-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2
  • rhacm2/submariner-rhel9-operator as a component of Red Hat Advanced Cluster Management for Kubernetes 2
  • rhceph/grafana-rhel10 as a component of Red Hat Ceph Storage 7
  • rhceph/grafana-rhel9 as a component of Red Hat Ceph Storage 7
  • odh-data-science-pipelines-argo-argoexec-container as a component of Red Hat OpenShift AI (RHOAI)
  • odh-data-science-pipelines-argo-workflowcontroller-container as a component of Red Hat OpenShift AI (RHOAI)
  • rhoai/odh-data-science-pipelines-argo-argoexec-rhel8.src as a component of Red Hat OpenShift AI (RHOAI)
Summary
An argument injection vulnerability was found in go-git. This flaw allows an attacker to set arbitrary values to git-upload-pack flags, leading to command or code execution, exposure of sensitive data, or other unintended behavior. This is only possible in configurations where the file transport protocol is being used.
Remediation
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Optional official sources

National CERT insights
?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

Choose official national sources for this report. Each advisory shows its original language. Your selection is remembered on this device and included in shared links.

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current
ENISA EUVD identifier

EUVD-2025-0045

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state
Present in the current official mapping
Known exploitation
Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score
Not supplied in the stored EUVD record
Advisory evidence
No linked advisory details stored yet
Recommended actionPatch only the product branches with a verified fix

Critical technical impact with a remotely reachable, unauthenticated path; no CISA KEV confirmation is currently recorded. Verified remediation exists for at least one product or source, but 1 structured product or package state remain unresolved. Apply remediation only to the exact product branch confirmed by its source.

Fix availability varies by product
01

What, why and how

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

What

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Why

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

Why

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

02

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path
a network path → Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface
Network
Privileges required
None: unauthenticated exploitation is possible
User interaction
None
Attack complexity
Low: no specialised conditions are recorded
Security boundary
Not a CVSS 4.0 base metric
Weakness
?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-88 ↗

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

CVSS vector
?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear

Common Vulnerability Scoring System 4.0: the compact vector below is decoded into plain language.

AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.ATPresentAttack requirements: A particular deployment or execution condition must be present.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.VCHighVulnerable-system confidentiality: A successful attack can cause a major loss.VIHighVulnerable-system integrity: A successful attack can cause a major loss.VAHighVulnerable-system availability: A successful attack can cause a major loss.SCNoneSubsequent-system confidentiality: No direct loss is represented by this metric.SINoneSubsequent-system integrity: No direct loss is represented by this metric.SANoneSubsequent-system availability: No direct loss is represented by this metric.
Post-exploitation / living off the land
No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.
NetworkUnauthenticatedCWE-88
A

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

BSI · German · WID-SEC-2025-0123Red Hat Enterprise Linux und and OpenShift (go-git): Mehrere Schwachstellen

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Grafana Komponente ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.

Official advisory ↗
Cyber Security Agency of Singapore · English · CSA-SB-20250108Security Bulletin 08 Jan 2025

The Cyber Security Agency of Singapore included this CVE in its official Security Bulletin 08 Jan 2025, published on 8 January 2025. Open the linked bulletin for the product, severity and reference information published in that issue.

Official advisory ↗
CERT-FR · French · CERTFR-2026-AVI-0249Multiples vulnérabilités dans les produits IBM

Record?id=CVE-2024-9042 Référence CVE CVE-2025-0426 https://www.cve.org/CVERecord?id=CVE-2025-0426 Référence CVE CVE-2025-13465 https://www.cve.org/CVERecord?id=CVE-2025-13465 Référence CVE CVE-2025-13867 https://www.cve.org/CVERecord?id=CVE-2025-13867 Référence CVE CVE-2025-14689 https://www.cve.org/CVERecord?id=CVE-2025-14689 Référence CVE CVE-2025-15284 https://www.cve.org/CVERecord?id=CVE-2025-15284 Référence CVE CVE-2025-15467 https://www.cve.org/CVERecord?id=CVE-2025-15467 Référence CVE CVE-2025-1767 https://www.cve.org/CVERecord?id=CVE-2025-1767 Référence CVE CVE-2025-21587 https://www.cve.org/CVERecord?id=CVE-2025-21587 Référence CVE CVE-2025-21613 https://www.cve.org/CVERecord?id=CVE-2025-21613 Référence CVE CVE-2025-21905 https://www.cve.org/CVERecord?id=CVE-2025-21905 Référence CVE CVE-2025-22085 https://www.cve.org/CVERecord?id=CVE-2025-22085 Référence CVE CVE-2025-22091 https://www.cve.org/CVERecord?id=CVE-2025-22091 Référence CVE CVE-2025-22113 https://www.cve.org/CVERecord?id=CVE-2025-22113 Référence CVE CVE-2025-22121 https://www.cve.org/CVERecord?id=CVE-2025-22121 Référence CVE CVE-2025-22233 https://www.cve.org/CVERecord?id=CVE-2025-22233 Référence CVE CVE-2025-22866 https://www.cve.org/CVERecord?id=CVE-2025-22866 Référence CVE CVE-2025-22868 https://www.cve.org/CVERecord?id=

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0622Multiples vulnérabilités dans les produits VMware

.org/CVERecord?id=CVE-2024-9287 Référence CVE CVE-2024-9681 https://www.cve.org/CVERecord?id=CVE-2024-9681 Référence CVE CVE-2025-0167 https://www.cve.org/CVERecord?id=CVE-2025-0167 Référence CVE CVE-2025-0725 https://www.cve.org/CVERecord?id=CVE-2025-0725 Référence CVE CVE-2025-0913 https://www.cve.org/CVERecord?id=CVE-2025-0913 Référence CVE CVE-2025-0938 https://www.cve.org/CVERecord?id=CVE-2025-0938 Référence CVE CVE-2025-1795 https://www.cve.org/CVERecord?id=CVE-2025-1795 Référence CVE CVE-2025-21502 https://www.cve.org/CVERecord?id=CVE-2025-21502 Référence CVE CVE-2025-21587 https://www.cve.org/CVERecord?id=CVE-2025-21587 Référence CVE CVE-2025-21613 https://www.cve.org/CVERecord?id=CVE-2025-21613 Référence CVE CVE-2025-21614 https://www.cve.org/CVERecord?id=CVE-2025-21614 Référence CVE CVE-2025-21941 https://www.cve.org/CVERecord?id=CVE-2025-21941 Référence CVE CVE-2025-21956 https://www.cve.org/CVERecord?id=CVE-2025-21956 Référence CVE CVE-2025-21957 https://www.cve.org/CVERecord?id=CVE-2025-21957 Référence CVE CVE-2025-21959 https://www.cve.org/CVERecord?id=CVE-2025-21959 Référence CVE CVE-2025-21962 https://www.cve.org/CVERecord?id=CVE-2025-21962 Référence CVE CVE-2025-21963 https://www.cve.org/CVERecord?id=CVE-2025-21963 Référence CVE CVE-2025-21964 https://www.cve.org/CVERecord?id=

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0337Multiples vulnérabilités dans les produits IBM

e.org/CVERecord?id=CVE-2024-57699 Référence CVE CVE-2024-6119 https://www.cve.org/CVERecord?id=CVE-2024-6119 Référence CVE CVE-2024-6531 https://www.cve.org/CVERecord?id=CVE-2024-6531 Référence CVE CVE-2024-6763 https://www.cve.org/CVERecord?id=CVE-2024-6763 Référence CVE CVE-2024-7254 https://www.cve.org/CVERecord?id=CVE-2024-7254 Référence CVE CVE-2024-8184 https://www.cve.org/CVERecord?id=CVE-2024-8184 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-1302 https://www.cve.org/CVERecord?id=CVE-2025-1302 Référence CVE CVE-2025-21502 https://www.cve.org/CVERecord?id=CVE-2025-21502 Référence CVE CVE-2025-21613 https://www.cve.org/CVERecord?id=CVE-2025-21613 Référence CVE CVE-2025-21614 https://www.cve.org/CVERecord?id=CVE-2025-21614 Référence CVE CVE-2025-22866 https://www.cve.org/CVERecord?id=CVE-2025-22866 Référence CVE CVE-2025-24970 https://www.cve.org/CVERecord?id=CVE-2025-24970 Référence CVE CVE-2025-25193 https://www.cve.org/CVERecord?id=CVE-2025-25193 Référence CVE CVE-2025-26791 https://www.cve.org/CVERecord?id=CVE-2025-26791 Référence CVE CVE-2025-27152 https://www.cve.org/CVERecord?id=CVE-2025-27152 Référence CVE CVE-2025-27789 https://www.cve.org/CVERecord?id=CVE-2025-27789 Gestion détaillée du document le 18 avril 2025 Version initial

Official advisory ↗
JVN iPedia · Japanese · JVNDB-2025-003623go-git project の Go 用 go-git における引数の挿入または変更に関する脆弱性

go-git project の Go 用 go-git には、引数の挿入または変更に関する脆弱性が存在します。

Official advisory ↗
03

Patch and workaround

Operational remediation based on structured source evidence.

Status
?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
Fix availability varies by product
Affected
Fixed
Action
Use the product-specific evidence above. Patch only products with a verified fixed release, and keep every affected or under-investigation state without a matching fix in the remediation queue.
Workaround
No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.
04

Evidence and provenance

Published 6 Jan 2025 · Last source change 6 Jan 2025, 16:45 UTC · CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CVE recordCVE.org · 5.1
CVSS sourceCNA
EPSS source
?The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.
FIRST · tracked since 2026-08-14
European sourceENISA EUVD · EUVD-2025-0045
Product sourceVendor CSAF · Red Hat Product Security
Remediation sourceVendor CSAF · Red Hat Product Security
CWE sourceCNA
NVD statusNVD enriched

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates ↗
  1. Affected versionsThe structured affected or fixed version information changed.
    Before
    >= 4.0.0, < 5.13.0 · Fixed: No fixed version is explicitly recorded in the structured CVE data.
    After
    >= 4.0.0, < 5.13.0 · Fixed: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
    Red Hat Product Security ↗
  2. Remediation statusRemediation status changed from Awaiting fix to Patch available.
    Before
    Awaiting fix
    After
    Patch available
    Red Hat Product Security ↗
  3. Affected versionsThe structured affected or fixed version information changed.
    Before
    openshift-builds/openshift-builds-image-bundler-rhel9.src as a component of Builds for Red Hat OpenShift; odo.src as a component of OpenShift Developer Tools and Services; openshift-serverless-1-func-utils-rhel8-container as a component of OpenShift Serverless; openshift-serverless-1/client-kn-rhel8 as a component of OpenShift Serverless; openshift-serverless-1/kn-cli-artifacts-rhel8 as a component of OpenShift Serverless; rhacm2/multicluster-operators-subscription-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2; rhacm2/submariner-rhel9-operator as a component of Red Hat Advanced Cluster Management for Kubernetes 2; rhceph/grafana-rhel10 as a component of Red Hat Ceph Storage 7; rhceph/grafana-rhel9 as a component of Red Hat Ceph Storage 7; odh-data-science-pipelines-argo-argoexec-container as a component of Red Hat OpenShift AI (RHOAI); odh-data-science-pipelines-argo-workflowcontroller-container as a component of Red Hat OpenShift AI (RHOAI); rhoai/odh-data-science-pipelines-argo-argoexec-rhel8.src as a component of Red Hat OpenShift AI (RHOAI); rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8.src as a component of Red Hat OpenShift AI (RHOAI); openshift4/ose-console as a component of Red Hat OpenShift Container Platform 4; container-native-virtualization/cluster-network-addons-operator as a component of Red Hat OpenShift Virtualization 4; container-native-virtualization/cluster-network-addons-operator-rhel9 as a component of Red Hat OpenShift Virtualization 4 · Fixed: openshift-gitops-1/argo-rollouts-rhel8@sha256:868a4e993d8963e4fb64c1845f54f916f335d3c59f0596e966c6d926373f6ee1_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:9b883e71b2d12f8872b3a37b383087a488f9b74ddde0e0c6daf6ee04bdf15881_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:bf7f9ca8f33c935df306554b778e5291bcff9e92b7e9122498b0ad71d58b9166_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:ce0677023395a6d7c9598b820c6eb73b651eaa698aef9f5c27a25884fba5d643_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:04523979e4ab58120d959f88503957b1e13122952e3de03d9f0540f1e574c0d6_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:64df9d55e7196fe56ebab88071f115d7fea26fa4396109bbf3bae11ffbf1f3a5_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:9017ef8967ebe3a14ea1e07d0a9624ef126b2928e233f09451aeea89a7f09366_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:ecb181ba7dfd4a5cdffa8ba9ca251dc4875ad7f41e9d60c4cc0a3462c233e489_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:050b358e7512599f412fddf711f8731d821223ba76c460b114fe4c4bfaf7cf1b_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:83ba395adbfdae8d4973cea02ead8392089ac1051edd11e7defc6d07a122bca2_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:dc4d641c87a3b65208ef2b46398f64ae69465daeb84b4d1022062d6c5f7347dc_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:e6eba59c8336bde1ed98947b2d4c626feb2113037bc724bd881f25b7f155f47b_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:065b95a1612d15b3a7de1c5822555851535199711cc3890d56d7cb01e01666b3_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:1c59649ad569e25c3445e9655c8061b7f0b769514c0739f2e080216a55ca39c7_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:490512fefae58c6092394c8e751b7c1761583bff23b815e6f1649d55e9d43002_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:605123efdd9f31243e039929322b4a4f6ad160baaebce188fdbf2c4e7ff663ff_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-operator-bundle@sha256:ba442571ef9180765055f5224548c73e3da2be31731f8dd5b6b1beaf3e6732ee_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:1b81b7c26d7a848797f9944254963a89c3f6f0e727355bafcda5e483fee7b848_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:2caf6bd42e10f063d0991740706946d4205bf49540865bd4ed9091176add2aed_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:951de21fc848014beb5db2f7307ef639c6c76ec6eb7036b18c07047c8a914c48_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:ed04d67b3bd9ebc21a0aa2503823e5a476da44caa165999a33670198f5d1be37_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:72e761f1d00b0a322d4a7a10c824fe88e4ac7e156a279694b75ce3b42be0b6d6_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:d20615c230e1b888bacdc374763eeca9b1f7612741f8ba52ded483ac688b858d_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:d86dcd96af06a338b577d9c940e6316ed9a807b9fc6a33d9f5c96e2b703679b8_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:f07aa6ccdc324a2631fc01b1f4af4317cdc0471c673bd8f5bf24560e0f012dd9_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:30b687a8309c17d5b4f5be6439b59f2dc540a306d625ee34bdf72626dc36c105_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:62e1ab7267cfd3536c3b2ba9592dffb7fb979cbb039a1a90320a03b751d5f728_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:b5ba9620f23fed74b983a090cec19f6ed74ddffdd1be7d9d89f1201c0c83c1b1_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:c0ec76e307a2867dc1064a3470e17a2e1533233e1a119ce5f32e2b3c07428d08_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/must-gather-rhel8@sha256:a909f1ebb5cf719e4308bbd162fea14e66b0ad6f7e91163699e8f9cbf61ec852_arm64 as a component of Red Hat OpenShift GitOps 1.14; and 523 more
    After
    openshift-builds/openshift-builds-image-bundler-rhel9.src as a component of Builds for Red Hat OpenShift; odo.src as a component of OpenShift Developer Tools and Services; openshift-serverless-1-func-utils-rhel8-container as a component of OpenShift Serverless; openshift-serverless-1/client-kn-rhel8 as a component of OpenShift Serverless; openshift-serverless-1/kn-cli-artifacts-rhel8 as a component of OpenShift Serverless; rhacm2/multicluster-operators-subscription-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2; rhacm2/submariner-rhel9-operator as a component of Red Hat Advanced Cluster Management for Kubernetes 2; rhceph/grafana-rhel10 as a component of Red Hat Ceph Storage 7; rhceph/grafana-rhel9 as a component of Red Hat Ceph Storage 7; odh-data-science-pipelines-argo-argoexec-container as a component of Red Hat OpenShift AI (RHOAI); odh-data-science-pipelines-argo-workflowcontroller-container as a component of Red Hat OpenShift AI (RHOAI); rhoai/odh-data-science-pipelines-argo-argoexec-rhel8.src as a component of Red Hat OpenShift AI (RHOAI); rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8.src as a component of Red Hat OpenShift AI (RHOAI); openshift4/ose-console-rhel9 as a component of Red Hat OpenShift Container Platform 4; container-native-virtualization/cluster-network-addons-operator as a component of Red Hat OpenShift Virtualization 4; container-native-virtualization/cluster-network-addons-operator-rhel9 as a component of Red Hat OpenShift Virtualization 4 · Fixed: openshift-gitops-1/argo-rollouts-rhel8@sha256:868a4e993d8963e4fb64c1845f54f916f335d3c59f0596e966c6d926373f6ee1_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:9b883e71b2d12f8872b3a37b383087a488f9b74ddde0e0c6daf6ee04bdf15881_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:bf7f9ca8f33c935df306554b778e5291bcff9e92b7e9122498b0ad71d58b9166_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argo-rollouts-rhel8@sha256:ce0677023395a6d7c9598b820c6eb73b651eaa698aef9f5c27a25884fba5d643_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:04523979e4ab58120d959f88503957b1e13122952e3de03d9f0540f1e574c0d6_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:64df9d55e7196fe56ebab88071f115d7fea26fa4396109bbf3bae11ffbf1f3a5_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:9017ef8967ebe3a14ea1e07d0a9624ef126b2928e233f09451aeea89a7f09366_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/argocd-rhel8@sha256:ecb181ba7dfd4a5cdffa8ba9ca251dc4875ad7f41e9d60c4cc0a3462c233e489_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:050b358e7512599f412fddf711f8731d821223ba76c460b114fe4c4bfaf7cf1b_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:83ba395adbfdae8d4973cea02ead8392089ac1051edd11e7defc6d07a122bca2_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:dc4d641c87a3b65208ef2b46398f64ae69465daeb84b4d1022062d6c5f7347dc_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/console-plugin-rhel8@sha256:e6eba59c8336bde1ed98947b2d4c626feb2113037bc724bd881f25b7f155f47b_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:065b95a1612d15b3a7de1c5822555851535199711cc3890d56d7cb01e01666b3_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:1c59649ad569e25c3445e9655c8061b7f0b769514c0739f2e080216a55ca39c7_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:490512fefae58c6092394c8e751b7c1761583bff23b815e6f1649d55e9d43002_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/dex-rhel8@sha256:605123efdd9f31243e039929322b4a4f6ad160baaebce188fdbf2c4e7ff663ff_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-operator-bundle@sha256:ba442571ef9180765055f5224548c73e3da2be31731f8dd5b6b1beaf3e6732ee_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:1b81b7c26d7a848797f9944254963a89c3f6f0e727355bafcda5e483fee7b848_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:2caf6bd42e10f063d0991740706946d4205bf49540865bd4ed9091176add2aed_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:951de21fc848014beb5db2f7307ef639c6c76ec6eb7036b18c07047c8a914c48_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8-operator@sha256:ed04d67b3bd9ebc21a0aa2503823e5a476da44caa165999a33670198f5d1be37_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:72e761f1d00b0a322d4a7a10c824fe88e4ac7e156a279694b75ce3b42be0b6d6_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:d20615c230e1b888bacdc374763eeca9b1f7612741f8ba52ded483ac688b858d_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:d86dcd96af06a338b577d9c940e6316ed9a807b9fc6a33d9f5c96e2b703679b8_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/gitops-rhel8@sha256:f07aa6ccdc324a2631fc01b1f4af4317cdc0471c673bd8f5bf24560e0f012dd9_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:30b687a8309c17d5b4f5be6439b59f2dc540a306d625ee34bdf72626dc36c105_amd64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:62e1ab7267cfd3536c3b2ba9592dffb7fb979cbb039a1a90320a03b751d5f728_arm64 as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:b5ba9620f23fed74b983a090cec19f6ed74ddffdd1be7d9d89f1201c0c83c1b1_ppc64le as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/kam-delivery-rhel8@sha256:c0ec76e307a2867dc1064a3470e17a2e1533233e1a119ce5f32e2b3c07428d08_s390x as a component of Red Hat OpenShift GitOps 1.14; openshift-gitops-1/must-gather-rhel8@sha256:a909f1ebb5cf719e4308bbd162fea14e66b0ad6f7e91163699e8f9cbf61ec852_arm64 as a component of Red Hat OpenShift GitOps 1.14; and 523 more
    Red Hat Product Security ↗
Material fields only · duplicate refreshes suppressed · history retained for the configured operational retention period
CVE published
Fixed release recorded from official guidance
ENISA EUVD · EUVD-2025-0045↗Red Hat Product Security security advisory↗CVE authority or vendor reference · GitHub GHSA-V725-9546-7Q7M↗Official CVE record (CNA and ADP data)↗NVD record↗
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
Free version - for non-commercial use only.CVE-2025-21613 · cve.blacktree.nl