Vulnérabilités / CVE-2026-45570

critique

CVE-2026-45570

github.com/go-git/go-git: go-git: Shell command injection in SSH transport

Publiée Modifiée CWE 116
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GHSA2.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
Red Hat6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), GHSA (faible), Azure Linux (faible).

Description

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
Azure Linux 3.0packer0:1.9.5-17.azl3
chainguardact, amazon-ssm-agent, amazon-ssm-agent-fips et 178 autres0.2.88-r4 et 155 autres
debian 12golang-github-go-git-go-gitpas de correctif indiqué
debian 13golang-github-go-git-go-gitpas de correctif indiqué
debian 14golang-github-go-git-go-git, golang-github-go-git-go-git-v65.19.1-1 et 1 autres
echogolang-github-go-git-go-gitpas de correctif indiqué
go::GitHub Security Advisory Gogithub.com/go-git/go-git, github.com/go-git/go-git/v5, github.com/go-git/go-git/v65.19.1 et 1 autres
minimosargo-events, argo-events-fips, argo-workflow-executor-3.7 et 100 autres1.9.10-r13 et 67 autres
rapidfort debian 12golang-github-go-git-go-git0:5.19.1-1
rapidfort debian 13golang-github-go-git-go-git0:5.19.1-1
wolfiact, apko, argo-cd-3.2 et 67 autres0.2.88-r4 et 69 autres
Afficher les 365 entrées de 11 sources
SourcePaquetCorrigé en
Azure Linux 3.0packer0:1.9.5-17.azl3
chainguardact0.2.88-r4
chainguardamazon-ssm-agent3.3.4364.0-r2
chainguardamazon-ssm-agent-fips3.3.4515.0-r1
chainguardapko1.2.13-r1
chainguardapko-fips1.2.13-r1
chainguardargo-cd-3.13.1.16-r3
chainguardargo-cd-3.23.2.12-r1
chainguardargo-cd-3.33.3.14-r9
chainguardargo-cd-3.43.4.2-r2
chainguardargo-cd-fips-3.13.1.16-r1
chainguardargo-cd-fips-3.23.2.12-r4
chainguardargo-cd-fips-3.33.3.10-r4
chainguardargo-cd-fips-3.43.4.2-r4
chainguardargo-events1.9.10-r22
chainguardargo-events-fips1.9.10-r16
chainguardargo-workflows-3.73.7.14-r4
chainguardargo-workflows-4.04.0.5-r5
chainguardargo-workflows-fips-3.73.7.14-r4
chainguardargo-workflows-fips-4.04.0.5-r5
chainguardargocd-image-updater1.2.1-r1
chainguardargocd-image-updater-fips1.2.0-r6
chainguardbom0.7.1-r20
chainguardcerbos0.53.0-r4
chainguardcerbos-fips0.53.0-r2
chainguardcg0.2.263-r1
chainguardchainctl0.2.264-r1
chainguardchainctl-fips0.2.263-r1
chainguardchainloop-cli1.98.2-r1
chainguardchainloop-cli-fips1.98.2-r1
chainguardcloudbeat-8.178.17.10-r20
chainguardcloudbeat-8.198.19.15-r3
chainguardcloudbeat-9.09.0.8-r23
chainguardcloudbeat-9.19.1.10-r16
chainguardcloudbeat-9.29.2.8-r3
chainguardcloudbeat-9.39.3.4-r5
chainguardcloudbeat-9.49.4.1-r1
chainguardcloudbeat-fips-8.178.17.10-r25
chainguardcloudbeat-fips-8.198.19.15-r1
chainguardcloudbeat-fips-9.09.0.8-r26
chainguardcloudbeat-fips-9.19.1.10-r19
chainguardcloudbeat-fips-9.29.2.8-r3
chainguardcloudbeat-fips-9.39.3.4-r4
chainguardcloudbeat-fips-9.49.4.1-r1
chainguardcoder2.32.4-r2
chainguardcoder-fips2.32.4-r1
chainguardcrossplane-1.201.20.7-r4
chainguardcrossplane-2.02.0.8-r3
chainguardcrossplane-2.12.1.5-r4
chainguardcrossplane-2.22.2.1-r3
chainguardcrossplane-fips-1.201.20.7-r4
chainguardcrossplane-fips-2.02.0.8-r3
chainguardcrossplane-fips-2.12.1.5-r4
chainguardcrossplane-fips-2.22.2.1-r4
chainguarddagger0.20.8-r6
chainguardexternal-secrets-operator-2.02.0.1-r12
chainguardexternal-secrets-operator-2.12.1.0-r12
chainguardexternal-secrets-operator-2.22.2.0-r10
chainguardexternal-secrets-operator-2.32.3.0-r8
chainguardexternal-secrets-operator-2.42.4.1-r5
chainguardexternal-secrets-operator-2.52.5.0-r1
chainguardexternal-secrets-operator-fips-2.02.0.1-r12
chainguardexternal-secrets-operator-fips-2.12.1.0-r11
chainguardexternal-secrets-operator-fips-2.22.2.0-r10
chainguardexternal-secrets-operator-fips-2.32.3.0-r6
chainguardexternal-secrets-operator-fips-2.42.4.1-r3
chainguardexternal-secrets-operator-fips-2.52.5.0-r1
chainguardflux-2.52.5.1-r26
chainguardflux-2.62.6.4-r25
chainguardflux-2.72.7.5-r18
chainguardflux-2.82.8.8-r0
chainguardflux-fips-2.52.5.1-r24
chainguardflux-fips-2.62.6.4-r22
chainguardflux-fips-2.72.7.5-r19
chainguardflux-fips-2.82.8.8-r0
chainguardflux-image-automation-controller1.1.4-r0
chainguardflux-image-automation-controller-fips1.1.4-r0
chainguardgitaly-18.1018.10.6-r3
chainguardgitaly-18.1118.11.4-r1
chainguardgitaly-18.918.9.7-r3
chainguardgitaly-fips-18.1018.10.6-r1
chainguardgitaly-fips-18.1118.11.3-r1
chainguardgitaly-fips-18.918.9.7-r1
chainguardgitea1.26.2-r0
chainguardgitea-fips1.26.2-r1
chainguardgitlab-rails-ce-18.1018.10.6-r3
chainguardgitlab-rails-ce-18.1118.11.3-r3
chainguardgitlab-rails-ce-19.019.0.4-r3
chainguardgitlab-rails-ce-19.119.1.2-r3
chainguardgitlab-rails-ce-fips-18.118.1.6-r13
chainguardgitlab-rails-ce-fips-18.1018.10.6-r2
chainguardgitlab-rails-ce-fips-18.1118.11.3-r4
chainguardgitlab-rails-ce-fips-18.918.9.7-r2
chainguardgitlab-rails-ce-fips-19.019.0.4-r1
chainguardgitlab-rails-ce-fips-19.119.1.2-r2
chainguardgitlab-runner-18.1018.10.1-r9
chainguardgitlab-runner-18.1118.11.3-r2
chainguardgitlab-runner-18.918.9.0-r13
chainguardgitlab-runner-fips-18.1018.10.1-r10
chainguardgitlab-runner-fips-18.1118.11.3-r5
chainguardgitsign0.16.0-r4
chainguardgomplate-44.3.3-r15
chainguardgomplate-55.1.0-r4
chainguardgomplate-fips-44.3.3-r14
chainguardgomplate-fips-55.1.0-r4
chainguardgoogle-osconfig-agent20251028.00-r18
chainguardgoreleaser2.15.4-r5
chainguardgptscript0.9.9-r156
chainguardgrafana-12.112.1.10.01-r16
chainguardgrafana-alloy1.16.1-r1
chainguardgrafana-alloy-fips1.16.1-r1
chainguardgrafana-fips-12.112.1.10.01-r6
chainguardgrype0.112.0-r3
chainguardgrype-db0.53.3-r3
chainguardgrype-fips0.112.0-r3
chainguardguac1.1.0-r16
chainguardjfrog-cli2.104.0-r1
chainguardk9s0.50.18-r25
chainguardk9s-fips0.50.18-r19
chainguardkaniko1.25.15-r1
chainguardkaniko-fips1.25.15-r1
chainguardkargo1.10.4-r1
chainguardkots1.130.4-r2
chainguardkubescape4.0.8-r4
chainguardkubescape-server4.0.8-r5
chainguardkubescape-server-fips4.0.8-r5
chainguardkubevela1.10.8-r7
chainguardkubevela-fips1.10.8-r8
chainguardkyverno-1.151.15.3-r19
chainguardkyverno-1.161.16.4-r5
chainguardkyverno-1.171.17.2-r35
chainguardkyverno-1.181.18.1-r1
chainguardkyverno-fips-1.151.15.20-r5
chainguardkyverno-fips-1.161.16.4-r4
chainguardkyverno-fips-1.171.17.2-r5
chainguardkyverno-fips-1.181.18.1-r1
chainguardmapotf0.0.0_git20260426-r3
chainguardmapotf-fips0.0.0_git20260426-r2
chainguardmelange0.50.7-r1
chainguardnemo2.7.3-r6
chainguardnfpm2.46.3-r3
chainguardnuclei3.8.0-r7
chainguardosv-scanner2.3.8-r2
chainguardpacker1.15.3-r5
chainguardpacker-fips1.15.3-r4
chainguardpulumi3.243.0-r0
chainguardpulumi-kubernetes-operator2.7.0-r6
chainguardpulumi-language-dotnet3.106.2-r2
chainguardpulumi-language-java1.28.0-r1
chainguardpulumi-language-yaml1.34.0-r2
chainguardrancher-fleet0.15.2-r0
chainguardrancher-fleet-fips0.15.1-r4
chainguardredpanda-console3.7.3-r0
chainguardscorecard5.5.0-r5
chainguardskaffold2.20.0-r1
chainguardskaffold-fips2.20.0-r1
chainguardsnyk-cli1.1304.3-r3
chainguardsrc-fingerprint0.19.0-r51
chainguardsrc-fingerprint-fips0.19.0-r34
chainguardsteampipe2.4.3-r1
chainguardsyft1.44.0-r4
chainguardsyft-fips1.44.0-r3
chainguardteleport-1717.7.24-r0
chainguardteleport-1818.8.2-r0
chainguardteleport-18.618.6.8-r20
chainguardterragrunt1.1.0-r0
chainguardterragrunt-fips1.1.0-r0
chainguardtfsec1.28.14-r34
chainguardtrivy0.70.0-r0
chainguardtrivy-fips0.69.3-r10
chainguardtrivy-operator0.30.1-r10
chainguardtrivy-operator-fips0.30.1-r8
chainguardtrufflehog3.94.3-r8
chainguardtrufflehog-fips3.94.3-r6
chainguardupwind-agent0.130.0-r0
chainguardwitness0.11.0-r4
chainguardwolfictl0.39.16-r1
chainguardxeol0.10.8-r40
chainguardxeol-fips0.10.8-r40
chainguardzarf0.76.0-r1
chainguardzarf-fips0.75.1-r5
chainguardzot2.1.17-r1
debian 12golang-github-go-git-go-gitpas de correctif indiqué
debian 13golang-github-go-git-go-gitpas de correctif indiqué
debian 14golang-github-go-git-go-git5.19.1-1
debian 14golang-github-go-git-go-git-v66.0.0~alpha4-1
echogolang-github-go-git-go-gitpas de correctif indiqué
go::GitHub Security Advisory Gogithub.com/go-git/go-gitpas de correctif indiqué
go::GitHub Security Advisory Gogithub.com/go-git/go-git/v55.19.1
go::GitHub Security Advisory Gogithub.com/go-git/go-git/v66.0.0-alpha.4
minimosargo-events1.9.10-r13
minimosargo-events-fips1.9.10-r14
minimosargo-workflow-executor-3.73.7.15-r0
minimosargo-workflow-executor-4.04.0.6-r0
minimosargo-workflow-executor-fips-3.73.7.15-r0
minimosargo-workflow-executor-fips-4.04.0.6-r0
minimosargo-workflows-3.73.7.15-r0
minimosargo-workflows-4.04.0.6-r0
minimosargo-workflows-fips-3.73.7.15-r0
minimosargo-workflows-fips-4.04.0.6-r0
minimosargocd-3.33.3.12-r2
minimosargocd-3.43.4.5-r2
minimosargocd-fips-3.33.3.12-r1
minimosargocd-fips-3.43.4.5-r2
minimosargocd-image-updater-fips-1.21.2.2-r2
minimoscerbos0.54.0-r0
minimoscerbos-fips0.54.0-r0
minimoscloud-query-db-0.120.12.28-r1
minimoscloud-query-db-0.12-fips0.12.29-r1
minimoscrossplane2.2.2-r0
minimosdatadog-agent7.65.1-r0
minimosexternal-secrets-operator2.7.0-r0
minimosexternal-secrets-operator-fips2.7.0-r0
minimosflux-cli-2.82.8.8-r0
minimosflux-cli-2.8-fips2.8.8-r0
minimosgitaly-19.119.1.1-r1
minimosgitaly-fips-19.119.1.1-r1
minimosgitea1.26.4-r1
minimosgitea-fips1.26.4-r1
minimosgitlab-runner-18.1118.11.3-r3
minimosgitlab-runner-19.019.0.1-r3
minimosgitlab-runner-19.119.1.0-r1
minimosgitlab-runner-fips-18.1118.11.3-r3
minimosgitlab-runner-fips-19.019.0.1-r3
minimosgitlab-runner-fips-19.119.1.0-r1
minimosgomplate5.1.0-r3
minimosgomplate-fips5.1.0-r3
minimosgrafana-alloy1.17.0-r0
minimosgrafana-alloy-fips1.17.0-r0
minimosgrype0.113.0-r0
minimosgrype-fips0.113.0-r0
minimoskyverno-1.161.16.4-r5
minimoskyverno-1.171.17.2-r6
minimoskyverno-1.181.18.2-r1
minimoskyverno-fips-1.161.16.4-r5
minimoskyverno-fips-1.171.17.2-r6
minimoskyverno-fips-1.181.18.2-r1
minimoslivekit-cli2.16.1-r0
minimoslivekit-cli-fips2.16.1-r0
minimospaketo-buildpacks-bundle-install0.9.10-r0
minimospaketo-buildpacks-bundler0.9.11-r0
minimospaketo-buildpacks-conda-env-update0.8.26-r0
minimospaketo-buildpacks-cpython1.18.29-r0
minimospaketo-buildpacks-dotnet-core-aspnet-runtime1.6.26-r0
minimospaketo-buildpacks-dotnet-core-sdk1.6.27-r0
minimospaketo-buildpacks-dotnet-execute1.2.28-r0
minimospaketo-buildpacks-dotnet-publish1.2.24-r0
minimospaketo-buildpacks-go-build2.4.26-r0
minimospaketo-buildpacks-go-build-2.4.202.4.20-r1
minimospaketo-buildpacks-go-dist2.10.15-r0
minimospaketo-buildpacks-go-dist-2.10.92.10.9-r1
minimospaketo-buildpacks-go-mod-vendor1.1.26-r0
minimospaketo-buildpacks-go-mod-vendor-1.1.211.1.21-r1
minimospaketo-buildpacks-httpd1.0.6-r0
minimospaketo-buildpacks-icu0.9.27-r0
minimospaketo-buildpacks-jam2.18.0-r0
minimospaketo-buildpacks-miniconda0.11.26-r0
minimospaketo-buildpacks-mri1.1.12-r0
minimospaketo-buildpacks-nginx1.0.28-r0
minimospaketo-buildpacks-node-engine8.1.3-r0
minimospaketo-buildpacks-npm-install2.3.20-r0
minimospaketo-buildpacks-passenger0.14.23-r0
minimospaketo-buildpacks-pip0.26.16-r0
minimospaketo-buildpacks-pip-install0.7.29-r0
minimospaketo-buildpacks-pipenv1.28.4-r0
minimospaketo-buildpacks-pipenv-install0.7.28-r0
minimospaketo-buildpacks-poetry0.17.6-r0
minimospaketo-buildpacks-poetry-install0.6.34-r0
minimospaketo-buildpacks-vsdbg0.6.27-r0
minimospaketo-buildpacks-yarn2.2.32-r0
minimospaketo-buildpacks-yarn-install2.7.14-r0
minimosplural-cli0.12.52-r0
minimosplural-cli-fips0.12.52-r0
minimospulumi-kubernetes-operator2.7.0-r1
minimospulumi-kubernetes-operator-fips2.7.0-r1
minimosteleport-1717.7.24-r0
minimosteleport-1818.8.2-r0
minimosteleport-fips-1717.7.24-r0
minimosteleport-fips-1818.8.2-r0
minimosterragrunt1.1.0-r0
minimosterragrunt-fips1.1.0-r0
minimostrufflehog3.95.6-r1
minimostrufflehog-fips3.95.6-r1
minimosvela-cli-1.101.10.9-r1
minimosvela-cli-1.111.11.0-r1
minimosvela-cli-fips-1.101.10.9-r1
minimosvela-cli-fips-1.111.11.0-r1
minimosvela-core-1.101.10.9-r1
minimosvela-core-1.111.11.0-r1
minimosvela-core-fips-1.101.10.9-r1
minimosvela-core-fips-1.111.11.0-r1
minimoszot2.1.17-r1
minimoszot-fips2.1.17-r1
rapidfort debian 12golang-github-go-git-go-git0:5.19.1-1
rapidfort debian 13golang-github-go-git-go-git0:5.19.1-1
wolfiact0.2.88-r4
wolfiapko1.2.13-r1
wolfiargo-cd-3.23.2.12-r1
wolfiargo-cd-3.33.3.14-r9
wolfiargo-cd-3.43.4.2-r2
wolfiargo-events1.9.10-r22
wolfiargo-workflows-3.73.7.14-r4
wolfiargo-workflows-4.04.0.5-r5
wolfiargocd-image-updater1.2.1-r1
wolfibom0.7.1-r20
wolficerbos0.53.0-r4
wolficrossplane-2.22.2.1-r3
wolfidagger0.20.8-r6
wolfiexternal-secrets-operator-2.12.1.0-r12
wolfiexternal-secrets-operator-2.22.2.0-r10
wolfiexternal-secrets-operator-2.32.3.0-r8
wolfiexternal-secrets-operator-2.42.4.1-r5
wolfiexternal-secrets-operator-2.52.5.0-r1
wolfiflux-2.72.7.5-r18
wolfiflux-2.82.8.8-r0
wolfiflux-image-automation-controller1.1.4-r0
wolfigitaly-18.1018.10.6-r3
wolfigitaly-18.1118.11.4-r1
wolfigitaly-18.918.9.7-r3
wolfigitea1.26.2-r0
wolfigitlab-runner-18.1018.10.1-r9
wolfigitlab-runner-18.1118.11.3-r2
wolfigitlab-runner-18.918.9.0-r13
wolfigitsign0.16.0-r4
wolfigomplate-55.1.0-r4
wolfigoreleaser2.15.4-r5
wolfigptscript0.9.9-r156
wolfigrafana-alloy1.16.1-r1
wolfigrype0.112.0-r3
wolfiguac1.1.0-r16
wolfik9s0.50.18-r25
wolfikaniko1.25.15-r1
wolfikargo1.10.4-r1
wolfikots1.130.4-r2
wolfikubescape4.0.8-r4
wolfikubevela1.10.8-r7
wolfikyverno-1.171.17.2-r35
wolfikyverno-1.181.18.1-r1
wolfimelange0.50.7-r1
wolfinfpm2.46.3-r3
wolfinuclei3.8.0-r7
wolfiosv-scanner2.3.8-r2
wolfipulumi3.243.0-r0
wolfipulumi-kubernetes-operator2.7.0-r6
wolfipulumi-language-dotnet3.106.2-r2
wolfipulumi-language-java1.28.0-r1
wolfipulumi-language-yaml1.34.0-r2
wolfirancher-fleet0.15.2-r0
wolfiscorecard5.5.0-r5
wolfiskaffold2.20.0-r1
wolfisnyk-cli1.1304.3-r3
wolfisrc-fingerprint0.19.0-r51
wolfisteampipe2.4.3-r1
wolfisyft1.44.0-r4
wolfiteleport-18.618.6.8-r20
wolfiterragrunt1.1.0-r0
wolfitfsec1.28.14-r34
wolfitrivy0.70.0-r0
wolfitrivy-operator0.30.1-r10
wolfitrufflehog3.94.3-r8
wolfiwitness0.11.0-r4
wolfiwolfictl0.39.16-r1
wolfixeol0.10.8-r40
wolfizarf0.76.0-r1
wolfizot2.1.17-r1

Références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.