CVE-2026-45570: go-git: Improper single-quote escaping in SSH transport
A flaw in the go-git library's SSH transport wraps the repository path in single quotes without escaping single quotes inside the path. A crafted path can break out of the quoted region of the remote exec command and add extra shell tokens. The record reports a critical NVD CVSS 3.1 score of 9.6, and the issue is fixed in 5.19.1 and 6.0.0-alpha.4.
Overview
The go-git library, a pure Go implementation of Git, builds the remote exec command for its SSH transport by placing the repository path inside single quotes. Single quotes found inside the path are not escaped, so the path can end the quoted region early and be interpreted as additional shell tokens. The weakness is classified as CWE-116, Improper Encoding or Escaping of Output.
Impact
- NVD scores the record at 9.6 (critical) under CVSS 3.1, with network attack vector, low complexity, no privileges required, user interaction required, changed scope, and high confidentiality, integrity and availability impact.
- The GitHub CNA assigns a much lower score under a newer CVSS standard, which the record lists as 2.3.
- SSVC data in the record rates technical impact as partial, exploitation as none and automatable as no.
- Whether an attacker can influence the repository path depends on how an application passes paths or URLs to go-git; this is an inference from the description.
Affected products and versions
- Go-git Go-git: version before 5.19.1, and version from 6.0.0-alpha.1 before 6.0.0-alpha.4.
- Go-git Project Go-git: versions before 5.19.1, and versions 6.0.0-alpha1, 6.0.0-alpha2 and 6.0.0-alpha3 as listed in the record.
- Fixed versions stated in the description: 5.19.1 and 6.0.0-alpha.4.
Exploitation status
- The record shows the vulnerability is not listed in CISA KEV.
- No confirmed exploitation in the wild appears in the sources consulted.
- The EPSS probability in the record is 0.00427 with a percentile of 0.35945.
Remediation and mitigation
- Upgrade go-git to 5.19.1 or to 6.0.0-alpha.4, depending on the release line in use.
- If an immediate upgrade is not possible, avoid passing repository paths from untrusted sources to the SSH transport and validate paths against a strict allowlist; this mitigation is an inference and is not described in the record.
- Review the official GitHub Security Advisory for vendor guidance.
Detection guidance
- Review application logs for repository path values that contain unusual quoting characters, especially where paths come from user input or external systems.
- Monitor for unexpected child processes spawned by services that use go-git over SSH.
- These checks are high-level suggestions and are not described in the record.
Limitations of the available information
- The record contains an empty fixes list; the fixed versions are taken from the description and the GHSA reference.
- Product naming differs between the two affected entries, and the version lists are not fully consistent.
- The record does not describe the exact conditions needed to exploit the flaw or any proof-of-concept details, and this analysis does not provide them.
- The record does not include the full CVSS 4.0 vector details for the lower score.
Frequently asked questions
What is the core problem in CVE-2026-45570?
The go-git SSH transport wraps the repository path in single quotes without escaping single quotes inside the path, so a crafted path can break out of the quoted region.
Which versions are fixed?
The description states the issue is fixed in 5.19.1 and 6.0.0-alpha.4. The record's fixes list is empty, so consult the GitHub advisory for details.
Is this vulnerability being actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.