CVE-2026-45570 go-git: Improper single-quote escaping in go-git SSH transport
Attackers can execute arbitrary commands via crafted repository paths in go-git SSH transport due to improper quote escaping.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45570?
CVE-2026-45570 is a low-severity command injection vulnerability in go-git, published on 27 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
Weakness: CWE-116
Which versions are affected by CVE-2026-45570?
9 open source packages ship an affected version, including github.com/go-git/go-git, github.com/go-git/go-git/v5 and github.com/go-git/go-git/v6. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-git/go-git Go | All versions | None |
github.com/go-git/go-git Go | All versions to 4.7.0 | None |
github.com/go-git/go-git Go | All versions to 4.7.0 | None |
github.com/go-git/go-git/v5 Go | All versions | 5.19.1 |
github.com/go-git/go-git/v5 Go | All versions | 5.19.1 |
github.com/go-git/go-git/v5 Go | All versions | 5.19.1 |
3 more packages
github.com/go-git/go-git/v6 Go | All versions | 6.0.0-alpha.4 |
github.com/go-git/go-git/v6 Go | All versions | 6.0.0-alpha.4 |
github.com/go-git/go-git/v6 Go | All versions | 6.0.0-alpha.4 |
Products include Go-Git Project Go-Git.
How do I fix CVE-2026-45570?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-45570 being exploited?
There is no known exploitation of CVE-2026-45570 in the wild and no public exploit code.
Other vulnerabilities in go-git
- CVE-2023-49569 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
- CVE-2025-21613 go-git has an Argument Injection via the URL field
- CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies
- CVE-2023-49568 Maliciously crafted Git server replies can cause DoS on go-git clients
- CVE-2026-45022 go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
Sources
Also known as AZL-88418, AZL-88800, BELL-CVE-2026-45570, CLEANSTART-2026-LG29530, CLEANSTART-2026-MD00840, CLEANSTART-2026-OJ94675 and 186 more.