github.com/go-git/go-git: go-git: Shell command injection in SSH transport (CVE-2026-45570)

Overview

A flaw was found in go-git, a library used for Git operations. The component responsible for secure shell (SSH) communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to manipulate the command executed on the server by including a specially crafted repository path. This could result in the appending of additional shell commands, potentially leading to unintended actions on the system.

Vendor advisories

• RHSA-2026:67543 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · advisory
• Red Hat VEX · Moderate · affected: Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-09-09 · vex

github.com/go-git/go-git: go-git: Shell command injection in SSH transport — rated Moderate by Red Hat. Released 2026-05-27, updated 2026-09-21.

Fixed:

• Red Hat Advanced Cluster Management for Kubernetes 2.17

Not affected:

• Red Hat Advanced Cluster Management for Kubernetes 2.17

Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67543

Package advisory (CVE-2026-45570)

Affected packages:

• github.com/go-git/go-git/v5 < 5.19.1
• github.com/go-git/go-git/v6 < 6.0.0-alpha.4
• github.com/go-git/go-git <= 4.7.0

Patched in:

• github.com/go-git/go-git/v5 5.19.1
• github.com/go-git/go-git/v6 6.0.0-alpha.4

Source: https://osv.dev/vulnerability/GHSA-m7cr-m3pv-hgrp