go-git: Improper single-quote escaping in go-git SSH transport
Description
Impact
go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. This diverges from canonical Git, which shell-quotes the path through sq_quote_buf so that an embedded ' becomes the '\'' close-escape-reopen sequence and the whole path round-trips as a single quoted argument.
A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. On SSH servers that evaluate the exec command through a shell (for example a user account whose login shell is /bin/sh or /bin/bash, or a ForceCommand wrapper that re-evaluates $SSH_ORIGINAL_COMMAND), those additional tokens execute in that account's command-execution context. SSH servers that tokenize the exec command without shell evaluation, including the canonical git-shell setup, are not affected.
The vulnerable behaviour is on the SSH server side, not in go-git: the same bytes can be produced by any SSH client. The change in go-git is defense-in-depth that restores parity with canonical Git's wire format and prevents go-git from being a vehicle for reaching shell-evaluating servers through attacker-influenced repository paths.
Patches
Users should upgrade to a patched version in order to mitigate this issue. The fix ports sq_quote_buf from canonical Git into go-git's SSH transport so that the wire output is byte-identical to what git itself would send for the same input.
Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.
Credit
Thanks to @N0zoM1z0 for reporting this to the go-git project. :bow:
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
go-git's SSH transport fails to escape single quotes in repository paths, enabling shell injection on servers that evaluate the exec command through a shell.
Vulnerability
The vulnerability resides in go-git's SSH transport, which constructs the remote exec command by wrapping the repository path in single quotes without escaping any single quotes embedded within the path [2][3]. This diverges from canonical Git, which uses sq_quote_buf to properly escape embedded single quotes as '\''. All versions of go-git prior to v5 are likely affected. The issue is server-side: SSH servers that evaluate the exec command through a shell (e.g., a login shell of /bin/sh or /bin/bash, or a ForceCommand that re-evaluates $SSH_ORIGINAL_COMMAND) are vulnerable, while servers using git-shell are not [2][3].
Exploitation
An attacker must influence the repository path used in a go-git SSH operation (e.g., clone or fetch) so that the path contains a single quote character. This single quote breaks out of the quoted region in the exec command, allowing the attacker to append additional shell tokens. The attack is only effective against SSH servers that pass the exec command to a shell for evaluation; servers that tokenize the command without shell evaluation are immune [2][3].
Impact
On a vulnerable SSH server, the attacker can execute arbitrary shell commands in the context of the SSH user account. This can lead to information disclosure, file modification, or further compromise of the server, depending on the privileges of that account [2][3].
Mitigation
Users should upgrade to a patched version of go-git (v5 or later) that ports sq_quote_buf from canonical Git, ensuring the wire output is byte-identical to what git itself would send [2][3]. No workaround is available; upgrading is the recommended action.
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.