CVE-2026-45570

EUVD-2026-32546

27.05.2026, 15:16

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.6 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 28%

Affected Products (NVD)

Vendor	Product	Version
go-git_project	go-git	𝑥 < 5.19.1
go-git_project	go-git	6.0.0:alpha1
go-git_project	go-git	6.0.0:alpha2
go-git_project	go-git	6.0.0:alpha3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

golang-github-go-git-go-git

bookworm	vulnerable
forky	5.19.1-1 fixed
sid	5.19.1-1 fixed
trixie	no-dsa

golang-github-go-git-go-git-v6

forky	vulnerable
sid	6.0.0~alpha.4-1 fixed

Common Weakness Enumeration

CWE-116 - Improper Encoding or Escaping of Output
The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References

https://github.com/go-git/go-git/security/advisories/GHSA-m7cr-m3pv-hgrp