go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Go-git |
|
No data.
No data.
References
History
Thu, 28 May 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 28 May 2026 04:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go-git
Go-git go-git |
|
| Vendors & Products |
Go-git
Go-git go-git |
Wed, 27 May 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4. | |
| Title | go-git: Improper single-quote escaping in go-git SSH transport | |
| Weaknesses | CWE-116 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-05-27T14:59:17.441Z
Updated: 2026-05-28T15:12:03.134Z
Reserved: 2026-05-12T19:00:14.600Z
Link: CVE-2026-45570
Vulnrichment
Updated: 2026-05-28T15:11:58.027Z
NVD
Status : Undergoing Analysis
Published: 2026-05-27T15:16:30.240
Modified: 2026-05-29T15:42:56.873
Link: CVE-2026-45570
Redhat
No data.