CVE-2026-45570 affects go-git, the pure Go git library. Its SSH transport does not escape single quotes in a repository path, so a crafted path can add shell tokens to the remote command. NVD scores it 9.6 (critical). It is fixed in go-git 5.19.1 and 6.0.0-alpha.4.
What's affected
The GitHub advisory lists these affected ranges:
github.com/go-git/go-git/v5: 5.19.0 and earliergithub.com/go-git/go-git/v6: 6.0.0-alpha.3 and earlier
Patched releases are 5.19.1 and 6.0.0-alpha.4. The advisory adds that older v5 releases are likely affected too and recommends moving to a supported version.
The severity needs context. NVD gives a CVSS 3.1 score of 9.6, but the GitHub advisory rates the issue Low (CVSS v4 2.3). It says the vulnerable behavior sits on the server side: the extra text only runs on SSH servers that pass the command through a shell. Servers that do not, such as a canonical git-shell setup, are not affected.
How to check if you're exposed
Look for go-git in your module graph.
go list -m all | grep go-git/go-git
go mod why -m github.com/go-git/go-git/v5
Many tools embed go-git without saying so, so run the check on every Go service and CLI you build, not only the ones that clone repositories. Then ask whether your code passes repository paths you do not control to the SSH transport.
What to do now
- Run the commands above across your Go repositories and list every go-git version.
- Upgrade to 5.19.1 or later on v5, or 6.0.0-alpha.4 on v6.
- Run
go mod tidy, rebuild and redeploy binaries. A fixed go.mod does nothing until the binary is rebuilt. - Until then, do not feed untrusted repository paths to the go-git SSH transport. The advisory lists no workaround, so this is a precaution, not vendor guidance.
Why it matters
The weakness is CWE-116, improper encoding or escaping of output. The library builds a remote command by wrapping the path in single quotes. A quote inside the path closes that wrapper early, and the rest is read as new shell words.
The fix ports the quoting logic from Git itself, so the output matches what canonical Git sends. The KEV flag for this CVE is false, and nothing I fetched says it is exploited.
Quick check
Does this affect me if I only clone over HTTPS?
The advisory describes the flaw in the SSH transport. HTTPS clones do not use that code path, but upgrading is still the simplest way to close the question.
Sources
Last reviewed: 19 October 2026.
