---
id: CVE-2026-45570
title: >-
  github.com/go-git/go-git: go-git: Shell command injection in SSH transport
  (CVE-2026-45570)
summary: >-
  A flaw was found in go-git, a library used for Git operations. The component
  responsible for secure shell (SSH) communication does not correctly handle
  special characters in repository paths. This oversight allows a remote
  attacker to mani…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cvssSource: vendor
cwe: CWE-88
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2.17
affected:
  - advanced_cluster_management_for_kubernetes 2.17
patched:
  - advanced_cluster_management_for_kubernetes 2.17
published: '2026-05-27'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T11:50:50+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45570.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45570.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-45570'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2482224'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-45570'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45570'
  - url: 'https://github.com/go-git/go-git/security/advisories/GHSA-m7cr-m3pv-hgrp'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67543'
  - url: 'https://github.com/go-git/go-git'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.00427
epssPercentile: 0.34252
aliases:
  - GHSA-m7cr-m3pv-hgrp
  - GO-2026-5496
ecosystem: go
ingestedAt: '2026-07-09T18:56:36.614Z'
---

## Overview

A flaw was found in go-git, a library used for Git operations. The component responsible for secure shell (SSH) communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to manipulate the command executed on the server by including a specially crafted repository path. This could result in the appending of additional shell commands, potentially leading to unintended actions on the system.

## Vendor advisories

- **RHSA-2026:67543** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67543)
- **Red Hat VEX** · Moderate · affected: Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45570.json)

**github.com/go-git/go-git: go-git: Shell command injection in SSH transport** — rated Moderate by Red Hat. Released 2026-05-27, updated 2026-09-21.

Fixed:

- Red Hat Advanced Cluster Management for Kubernetes 2.17

Not affected:

- Red Hat Advanced Cluster Management for Kubernetes 2.17

## Remediation

Before you apply this update, make sure all previously released errata
that are relevant to your system are applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67543

## Package advisory (CVE-2026-45570)

Affected packages:

- `github.com/go-git/go-git/v5 < 5.19.1`
- `github.com/go-git/go-git/v6 < 6.0.0-alpha.4`
- `github.com/go-git/go-git <= 4.7.0`

Patched in:

- `github.com/go-git/go-git/v5 5.19.1`
- `github.com/go-git/go-git/v6 6.0.0-alpha.4`

Source: https://osv.dev/vulnerability/GHSA-m7cr-m3pv-hgrp