{"id":"CVE-2026-45570","title":"github.com/go-git/go-git: go-git: Shell command injection in SSH transport (CVE-2026-45570)","summary":"A flaw was found in go-git, a library used for Git operations. The component responsible for secure shell (SSH) communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to mani…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvssSource":"vendor","cwe":"CWE-88","vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.17","affected":["advanced_cluster_management_for_kubernetes 2.17"],"patched":["advanced_cluster_management_for_kubernetes 2.17"],"published":"2026-05-27","updated":"2026-09-21","sourceUpdated":"2026-09-21T11:50:50+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45570.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45570.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-45570"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482224"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45570"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45570"},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-m7cr-m3pv-hgrp"},{"url":"https://access.redhat.com/errata/RHSA-2026:67543"},{"url":"https://github.com/go-git/go-git"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00365,"epssPercentile":0.30402,"aliases":["GHSA-m7cr-m3pv-hgrp","GO-2026-5496"],"ecosystem":"go","ingestedAt":"2026-07-09T18:56:36.614Z","slug":"CVE-2026-45570","body":"## Overview\n\nA flaw was found in go-git, a library used for Git operations. The component responsible for secure shell (SSH) communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to manipulate the command executed on the server by including a specially crafted repository path. This could result in the appending of additional shell commands, potentially leading to unintended actions on the system.\n\n## Vendor advisories\n\n- **RHSA-2026:67543** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67543)\n- **Red Hat VEX** · Moderate · affected: Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45570.json)\n\n**github.com/go-git/go-git: go-git: Shell command injection in SSH transport** — rated Moderate by Red Hat. Released 2026-05-27, updated 2026-09-21.\n\nFixed:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n\nNot affected:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n\n## Remediation\n\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67543\n\n## Package advisory (CVE-2026-45570)\n\nAffected packages:\n\n- `github.com/go-git/go-git/v5 < 5.19.1`\n- `github.com/go-git/go-git/v6 < 6.0.0-alpha.4`\n- `github.com/go-git/go-git <= 4.7.0`\n\nPatched in:\n\n- `github.com/go-git/go-git/v5 5.19.1`\n- `github.com/go-git/go-git/v6 6.0.0-alpha.4`\n\nSource: https://osv.dev/vulnerability/GHSA-m7cr-m3pv-hgrp","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201682,"id":"CVE-2026-45570","ts":1789399605578,"field":"cvss","old":null,"new":"6.3"},{"seq":201681,"id":"CVE-2026-45570","ts":1789399605578,"field":"severity","old":"low","new":"medium"},{"seq":200414,"id":"CVE-2026-45570","ts":1789397210022,"field":"cvss","old":"6.3","new":null},{"seq":200413,"id":"CVE-2026-45570","ts":1789397210022,"field":"severity","old":"medium","new":"low"},{"seq":198338,"id":"CVE-2026-45570","ts":1789391843645,"field":"cvss","old":null,"new":"6.3"},{"seq":198337,"id":"CVE-2026-45570","ts":1789391843645,"field":"severity","old":"low","new":"medium"},{"seq":196131,"id":"CVE-2026-45570","ts":1789383484715,"field":"cvss","old":"6.3","new":null},{"seq":196130,"id":"CVE-2026-45570","ts":1789383484715,"field":"severity","old":"medium","new":"low"},{"seq":195060,"id":"CVE-2026-45570","ts":1789380374789,"field":"cvss","old":null,"new":"6.3"},{"seq":195059,"id":"CVE-2026-45570","ts":1789380374789,"field":"severity","old":"low","new":"medium"},{"seq":193847,"id":"CVE-2026-45570","ts":1789378332651,"field":"cvss","old":"6.3","new":null},{"seq":193846,"id":"CVE-2026-45570","ts":1789378332651,"field":"severity","old":"medium","new":"low"},{"seq":192634,"id":"CVE-2026-45570","ts":1789376324910,"field":"cvss","old":null,"new":"6.3"},{"seq":192633,"id":"CVE-2026-45570","ts":1789376324910,"field":"severity","old":"low","new":"medium"},{"seq":191421,"id":"CVE-2026-45570","ts":1789373241105,"field":"cvss","old":"6.3","new":null},{"seq":191420,"id":"CVE-2026-45570","ts":1789373241105,"field":"severity","old":"medium","new":"low"},{"seq":190206,"id":"CVE-2026-45570","ts":1789369203079,"field":"cvss","old":null,"new":"6.3"},{"seq":190205,"id":"CVE-2026-45570","ts":1789369203079,"field":"severity","old":"low","new":"medium"},{"seq":188993,"id":"CVE-2026-45570","ts":1789368107474,"field":"cvss","old":"6.3","new":null},{"seq":188992,"id":"CVE-2026-45570","ts":1789368107474,"field":"severity","old":"medium","new":"low"},{"seq":187776,"id":"CVE-2026-45570","ts":1789365064221,"field":"cvss","old":null,"new":"6.3"},{"seq":187775,"id":"CVE-2026-45570","ts":1789365064221,"field":"severity","old":"low","new":"medium"},{"seq":186563,"id":"CVE-2026-45570","ts":1789363092827,"field":"cvss","old":"6.3","new":null},{"seq":186562,"id":"CVE-2026-45570","ts":1789363092827,"field":"severity","old":"medium","new":"low"},{"seq":185349,"id":"CVE-2026-45570","ts":1789361025792,"field":"cvss","old":null,"new":"6.3"},{"seq":185348,"id":"CVE-2026-45570","ts":1789361025792,"field":"severity","old":"low","new":"medium"},{"seq":184136,"id":"CVE-2026-45570","ts":1789358009339,"field":"cvss","old":"6.3","new":null},{"seq":184135,"id":"CVE-2026-45570","ts":1789358009339,"field":"severity","old":"medium","new":"low"},{"seq":182387,"id":"CVE-2026-45570","ts":1789354155869,"field":"cvss","old":null,"new":"6.3"},{"seq":182386,"id":"CVE-2026-45570","ts":1789354155869,"field":"severity","old":"low","new":"medium"},{"seq":181180,"id":"CVE-2026-45570","ts":1789352998156,"field":"cvss","old":"6.3","new":null},{"seq":181179,"id":"CVE-2026-45570","ts":1789352998156,"field":"severity","old":"medium","new":"low"},{"seq":179973,"id":"CVE-2026-45570","ts":1789350075306,"field":"cvss","old":null,"new":"6.3"},{"seq":179972,"id":"CVE-2026-45570","ts":1789350075306,"field":"severity","old":"low","new":"medium"},{"seq":178766,"id":"CVE-2026-45570","ts":1789347933218,"field":"cvss","old":"6.3","new":null},{"seq":178765,"id":"CVE-2026-45570","ts":1789347933218,"field":"severity","old":"medium","new":"low"},{"seq":177559,"id":"CVE-2026-45570","ts":1789346218945,"field":"cvss","old":null,"new":"6.3"},{"seq":177558,"id":"CVE-2026-45570","ts":1789346218945,"field":"severity","old":"low","new":"medium"},{"seq":176352,"id":"CVE-2026-45570","ts":1789342843249,"field":"cvss","old":"6.3","new":null},{"seq":176351,"id":"CVE-2026-45570","ts":1789342843249,"field":"severity","old":"medium","new":"low"},{"seq":175806,"id":"CVE-2026-45570","ts":1789338626460,"field":"cvss","old":null,"new":"6.3"},{"seq":175805,"id":"CVE-2026-45570","ts":1789338626460,"field":"severity","old":"low","new":"medium"},{"seq":175676,"id":"CVE-2026-45570","ts":1789338464006,"field":"cvss","old":"6.3","new":null},{"seq":175675,"id":"CVE-2026-45570","ts":1789338464006,"field":"severity","old":"medium","new":"low"},{"seq":174471,"id":"CVE-2026-45570","ts":1789334655572,"field":"cvss","old":null,"new":"6.3"},{"seq":174470,"id":"CVE-2026-45570","ts":1789334655572,"field":"severity","old":"low","new":"medium"},{"seq":173266,"id":"CVE-2026-45570","ts":1789333341406,"field":"cvss","old":"6.3","new":null},{"seq":173265,"id":"CVE-2026-45570","ts":1789333341406,"field":"severity","old":"medium","new":"low"},{"seq":172080,"id":"CVE-2026-45570","ts":1789330940686,"field":"cvss","old":null,"new":"6.3"},{"seq":172079,"id":"CVE-2026-45570","ts":1789330940686,"field":"severity","old":"low","new":"medium"}]}