CVE-2026-45570
📛 CVE Title
go-git: Improper single-quote escaping in go-git SSH transport
Description
go-git: Improper single-quote escaping in go-git SSH transport
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2026-45570 on 2026-10-31. Shown when MITRE's text differs from the cvelistV5 mirror.
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- critical
- CVSS score
- 9.1 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Effective score
- 9.1 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-116 - Reserved
- —
- Published
- 2026-05-12 07:00 UTC
- Last updated
- 2026-06-19 14:40 UTC
- Source
- https://www.tenable.com/cve/CVE-2026-45570
- Linked Threat
- CVE-2026-45570 — CVE-2026-45570
NVD / KEV / EPSS data refreshed 2026-05-25 00:14 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-32546 - Assigner
- GitHub_M
- Published
- May 27, 2026, 2:59:17 PM
- Updated
- May 28, 2026, 3:12:03 PM
- EUVD base score (CVSS 4.0)
-
2.3 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L - EUVD-reported EPSS
- 0.3700
- Vendors
- go-git
- Products
-
go-git (6.0.0-alpha.1, < 6.0.0-alpha.4)go-git (< 5.19.1)
- Aliases
-
GHSA-m7cr-m3pv-hgrp
ENISA description: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
EUVD references (1)
Microsoft Security Response Center MSRC
Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-11-05 03:38 UTC (source: CVRF).
- MS severity
- Low
- Release
- 2026-May
Microsoft remediations / KB articles (2)
- CBL-Mariner Releases — Vendor Fix / Security Update (fixed build 1.9.5-17)
- https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade — None Available / CBL-Mariner Releases
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (6)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- None Available msrc
- MSRC update guide: CVE-2026-45570 msrc
- https://github.com/go-git/go-git/security/advisories/GHSA-m7cr-m3pv-hgrp tenable:github.com
- https://www.first.org/epss/ tenable:www.first.org
- https://nvd.nist.gov/vuln/detail/CVE-2026-45570 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-45570 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:feedly.com
Patch <p>Users should upgrade to a patched version in order to mitigate this issue. The fix ports <code>sq_quote_buf</code> from canonical Git into <code>go-git</code>'s SSH transport so that the wire output is byte-identical to what <code>git</code> itself would send for the same input.</p> <p>Versions prior to <code>v5</code> are likely to be affected, users are recommended to upgrade to a ...
2026-05-26 02:59 UTC -
web:patch.com
Huntington Latest Headlines: New Family-Owned Butcher Shop + Italian Sushi + $61M Downtown Project; 🌱 Patch AM: Which big-name acts are hitting Huntington and Jones Beach this summer?; Best Buy ...
2026-05-26 02:59 UTC -
web:patch.moe
Age Verification Are you 18 years or older? YES NO
2026-05-26 02:59 UTC -
web:patchnashville.com
Patch was born out of a love of children's fashion and classic yet modern gifting. The goal was to create a timeless yet modern boutique with a playful touch featuring children's clothing, gifts, & accessories. My hope is that you always find what you came for and feel as inspired by our collections as we are.
2026-05-26 02:59 UTC -
web:robertsspaceindustries.com
Hi Everyone! Time again for another Hotfix Central thread to keep you all up to date on things going on outside of the normal patch cycle in SC Alpha 4.8 LIVE! This will be a living document of...
2026-05-26 02:59 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.
2026-05-26 02:59 UTC -
web:www.cisa.gov
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.
2026-05-26 02:59 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-26 02:59 UTC -
web:www.leagueoflegends.com
League of Legends Patch 26.5 Notes Welcome to the official patch of First Stand, the first major international tournament of the year!
2026-05-26 02:59 UTC -
web:www.screwfix.com
Screwfix offers a wide range of trade tools and hardware at competitive prices with convenient delivery and collection options.
2026-05-26 02:59 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.