CVE-2026-45570: go-git_project go-git Improper Encoding or Escaping of Output

CVSS: 9.6v3.1CriticalAnalyzed

AliasesUBUNTU-CVE-2026-45570DEBIAN-CVE-2026-45570CGA-23mm-vj96-6qh7+566 more

Published 27-05-2026Last modified 28-05-2026

Vulnerability summary

CVE-2026-45570 is a critical (CVSS 9.6) Improper Encoding or Escaping of Output vulnerability in go-git_project go-git. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.6% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.6/10

010

Critical · v3.1 (NVD)

EPSS score

0.43%

0%100%

Low · +0.06 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3

OPENSUSE-SU-2026:10831-1 OPENSUSE-SU-2026:21483-1 CGA-4FX8-V7VX-V65M

Timeline

27-05-2026
PublishedVulnerability first disclosed.
28-05-2026
Last modifiedVulnerability information updated.

Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

CVSS metrics

9 scores · 7 sources · 2 versions

v4.02.3v3.19.6

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

+0.06 pp

From 0.36% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Affected systems

Chainguard200 products

act< 0.2.88-r4
amazon-ssm-agent< 3.3.4364.0-r2
amazon-ssm-agent-ecs-exec< 3.3.4364.0-r2
amazon-ssm-agent-ecs-exec-fips< 3.3.4515.0-r0 | < 3.3.4515.0-r1
amazon-ssm-agent-fips< 3.3.4515.0-r1

apko< 1.2.13-r1
apko-fips< 1.2.13-r1
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1< 3.1.16-r3
argo-cd-3.1-compat< 3.1.16-r3
argo-cd-3.2< 3.2.12-r1
argo-cd-3.2-compat< 3.2.12-r1
argo-cd-3.3-compat< 3.3.14-r9 | < 3.3.10-r3 | All versions (No fix recorded)
argo-cd-3.4< 3.4.2-r2
argo-cd-3.4-compat< 3.4.2-r2
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1< 3.1.16-r1
argo-cd-fips-3.1-compat< 3.1.16-r1
argo-cd-fips-3.2< 3.2.12-r4
argo-cd-fips-3.2-compat< 3.2.12-r4
argo-cd-fips-3.3< 3.3.10-r4
argo-cd-fips-3.3-compat< 3.3.10-r4
argo-cd-fips-3.4< 3.4.2-r4
argo-cd-fips-3.4-compat< 3.4.2-r4
argo-events< 1.9.10-r22
argo-events-fips< 1.9.10-r16
argo-workflow-executor-3.6All versions (No fix recorded)
argo-workflow-executor-3.7< 3.7.14-r4
argo-workflow-executor-4.0< 4.0.5-r5
argo-workflow-executor-fips-3.6All versions (No fix recorded)
argo-workflow-executor-fips-3.7< 3.7.14-r4
argo-workflow-executor-fips-4.0< 4.0.5-r5
argo-workflows-3.6All versions (No fix recorded)
argo-workflows-3.7< 3.7.14-r4
argo-workflows-4.0< 4.0.5-r5
argo-workflows-fips-3.6All versions (No fix recorded)
argo-workflows-fips-3.7< 3.7.14-r4
argo-workflows-fips-4.0< 4.0.5-r5
argocd-image-updater< 1.2.1-r1
argocd-image-updater-fips< 1.2.0-r6
bom< 0.7.1-r20
cerbos< 0.53.0-r4
cerbos-fips< 0.53.0-r2
cerbosctl< 0.53.0-r4
cerbosctl-fips< 0.53.0-r2
cg< 0.2.263-r1
chainctl< 0.2.264-r1
chainctl-fips< 0.2.263-r1
chainloop-cli< 1.98.2-r0 | < 1.98.2-r1
chainloop-cli-fips< 1.98.2-r0 | < 1.98.2-r1
cloudbeat-8.17< 8.17.10-r20
cloudbeat-8.19< 8.19.15-r3
cloudbeat-9.0< 9.0.8-r23
cloudbeat-9.1< 9.1.10-r16
cloudbeat-9.2< 9.2.8-r3
cloudbeat-9.3< 9.3.4-r5
cloudbeat-9.4< 9.4.1-r1
cloudbeat-fips-8.17< 8.17.10-r25
cloudbeat-fips-8.19< 8.19.15-r1
cloudbeat-fips-9.0< 9.0.8-r26
cloudbeat-fips-9.1< 9.1.10-r19
cloudbeat-fips-9.2< 9.2.8-r3
cloudbeat-fips-9.3< 9.3.4-r4
cloudbeat-fips-9.4< 9.4.1-r1
coder< 2.32.4-r2
coder-fips< 2.32.4-r1
commercial-chainloop-cliAll versions (No fix recorded)
commercial-grafana-12.1All versions (No fix recorded)
crossplane-1.20-crank< 1.20.7-r4
crossplane-2.0-crank< 2.0.8-r3
crossplane-2.1-crank< 2.1.5-r4
crossplane-2.2-crank< 2.2.1-r3
crossplane-fips-1.20-crank< 1.20.7-r4
crossplane-fips-2.0-crank< 2.0.8-r3
crossplane-fips-2.1-crank< 2.1.5-r4
crossplane-fips-2.2-crank< 2.2.1-r4
dagger< 0.20.8-r6
external-secrets-operator-1.0All versions (No fix recorded)
external-secrets-operator-1.1All versions (No fix recorded)
external-secrets-operator-1.2All versions (No fix recorded)
external-secrets-operator-1.3All versions (No fix recorded)
external-secrets-operator-2.0< 2.0.1-r12
external-secrets-operator-2.1< 2.1.0-r12
external-secrets-operator-2.2< 2.2.0-r10
external-secrets-operator-2.3< 2.3.0-r8
external-secrets-operator-2.4< 2.4.1-r5
external-secrets-operator-2.5< 2.5.0-r1
external-secrets-operator-fips-1.0All versions (No fix recorded)
external-secrets-operator-fips-1.1All versions (No fix recorded)
external-secrets-operator-fips-1.2All versions (No fix recorded)
external-secrets-operator-fips-1.3All versions (No fix recorded)
external-secrets-operator-fips-2.0< 2.0.1-r12
external-secrets-operator-fips-2.1< 2.1.0-r11
external-secrets-operator-fips-2.2< 2.2.0-r10
external-secrets-operator-fips-2.3< 2.3.0-r6
external-secrets-operator-fips-2.4< 2.4.1-r3
external-secrets-operator-fips-2.5< 2.5.0-r1
flux-2.5< 2.5.1-r26
flux-2.6< 2.6.4-r25
flux-2.7< 2.7.5-r18
flux-2.8< 2.8.8-r0
flux-fips-2.5< 2.5.1-r24
flux-fips-2.6< 2.6.4-r22
flux-fips-2.7< 2.7.5-r19
flux-fips-2.8< 2.8.8-r0
flux-image-automation-controller< 1.1.4-r0
flux-image-automation-controller-fips< 1.1.4-r0
gitaly-18.10< 18.10.6-r3
gitaly-18.11< 18.11.4-r1
gitaly-18.6All versions (No fix recorded)
gitaly-18.7All versions (No fix recorded)
gitaly-18.8All versions (No fix recorded)
gitaly-18.9< 18.9.7-r3
gitaly-fips-18.10< 18.10.6-r1
gitaly-fips-18.11< 18.11.3-r1
gitaly-fips-18.9< 18.9.7-r1
gitea< 1.26.2-r0
gitea-fips< 1.26.2-r1
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10< 18.10.6-r3
gitlab-rails-ce-18.11< 18.11.3-r3
gitlab-rails-ce-18.3All versions (No fix recorded)
gitlab-rails-ce-18.4All versions (No fix recorded)
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0< 19.0.4-r3
gitlab-rails-ce-19.1< 19.1.2-r3
gitlab-rails-ce-fips-18.1< 18.1.6-r13
gitlab-rails-ce-fips-18.10< 18.10.6-r2
gitlab-rails-ce-fips-18.11< 18.11.3-r4
gitlab-rails-ce-fips-18.3All versions (No fix recorded)
gitlab-rails-ce-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9< 18.9.7-r2
gitlab-rails-ce-fips-19.0< 19.0.4-r1
gitlab-rails-ce-fips-19.1< 19.1.2-r2
gitlab-runner-18.10< 18.10.1-r9
gitlab-runner-18.11< 18.11.3-r2
gitlab-runner-18.6All versions (No fix recorded)
gitlab-runner-18.7All versions (No fix recorded)
gitlab-runner-18.8All versions (No fix recorded)
gitlab-runner-18.9< 18.9.0-r13
gitlab-runner-fips-18.10< 18.10.1-r10
gitlab-runner-fips-18.11< 18.11.3-r5
gitlab-runner-fips-18.9All versions (No fix recorded)
gitlab-runner-helper-18.10< 18.10.1-r9
gitlab-runner-helper-18.11< 18.11.3-r2
gitlab-runner-helper-18.6All versions (No fix recorded)
gitlab-runner-helper-18.7All versions (No fix recorded)
gitlab-runner-helper-18.8All versions (No fix recorded)
gitlab-runner-helper-18.9< 18.9.0-r13
gitlab-runner-helper-fips-18.10< 18.10.1-r10
gitlab-runner-helper-fips-18.11< 18.11.3-r5
gitlab-runner-helper-fips-18.9All versions (No fix recorded)
gitsign< 0.16.0-r4
gomplate-4< 4.3.3-r15
gomplate-5< 5.1.0-r4
gomplate-fips-4< 4.3.3-r14
gomplate-fips-5< 5.1.0-r4
google-osconfig-agent< 20251028.00-r18
goreleaser< 2.15.4-r5
gptscript< 0.9.9-r145 | < 0.9.9-r156
grafana-12.0All versions (No fix recorded)
grafana-12.1< 12.1.10.01-r16
grafana-alloy< 1.16.1-r1
grafana-alloy-fips< 1.16.1-r1
grafana-fips-12.0All versions (No fix recorded)
grafana-fips-12.1< 12.1.10.01-r6
grype< 0.112.0-r3
grype-db< 0.53.3-r3
grype-fips< 0.112.0-r3
guac< 1.1.0-r16
guacingest< 1.1.0-r16
guacone< 1.1.0-r16
jfrog-cli< 2.104.0-r1
k9s< 0.50.18-r25
k9s-fips< 0.50.18-r19
kaniko< 1.25.15-r1
kaniko-fips< 1.25.15-r1
kargo< 1.10.4-r1
kots< 1.130.4-r2
kubescape< 4.0.8-r4
kubescape-server< 4.0.8-r5
kubescape-server-downloader< 4.0.8-r5
kubescape-server-fips< 4.0.8-r5
kubescape-server-fips-downloader< 4.0.8-r5
kubevela-vela-cli< 1.10.8-r7
kubevela-vela-cli-fips< 1.10.8-r8
kubevela-vela-core< 1.10.8-r7
kubevela-vela-core-fips< 1.10.8-r8
kyverno-1.17< 1.17.2-r35 | All versions (No fix recorded)
kyverno-cli-1.14All versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 369. Use Open JSON for the complete list.

References

7 links

github.com/go-git/go-git/security/advisories/GHSA-m7cr-m3pv-hgrpX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
ubuntu.com/security/CVE-2026-45570REPORT
www.cve.org/CVERecord?id=CVE-2026-45570REPORT
security-tracker.debian.org/tracker/CVE-2026-45570Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45570.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-45570AdvisoryOval
github.com/go-git/go-gitPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities