go-git CVE-2026-45570

Exploitation requires two simultaneous conditions. First, the attacker must control or influence the repository path value passed into go-git's SSH transport - for example through a user-supplied clone URL, a server-side redirect, or a configuration value sourced from untrusted input. Second, the SSH server receiving the connection must evaluate the exec command through a Unix shell (e.g., the git service account's login shell is /bin/sh or /bin/bash, or a ForceCommand directive passes $SSH_ORIGINAL_COMMAND to a shell for further evaluation). Exploitation is NOT possible against SSH servers that use git-shell, which tokenizes the exec command without shell evaluation. Standard hosted Git platforms (GitHub, GitLab, Gitea in default configuration) are therefore not affected. Authentication requirements cannot be confirmed from available data because no CVSS vector is provided; the requirement to authenticate to the SSH server before the exec command is evaluated likely limits unauthenticated exploitation, but this is inferred, not confirmed.

No CVSS vector or EPSS data is present in the available intelligence, preventing quantitative scoring. Risk must therefore be assessed qualitatively. The advisory tags include 'Information Disclosure' but the described impact is arbitrary shell command execution in the SSH server's command context - a materially higher severity than that tag suggests; confirm with vendor whether the tag is accurate or understated. Exploitation is gated by two conditions that significantly limit the real-world attack surface: (1) the attacker must be able to influence the repository path passed to go-git, and (2) the target SSH server must evaluate the exec command through a shell rather than tokenizing it directly. Standard git-shell deployments are explicitly NOT affected, which covers the majority of hosted Git services. Self-hosted setups with user accounts whose login shell is /bin/sh or /bin/bash, or custom ForceCommand wrappers that re-evaluate $SSH_ORIGINAL_COMMAND, represent the realistic risk population. No CISA KEV listing, no POC, and no EPSS score exist at time of analysis; risk priority should be determined by whether the deploying organization runs shell-evaluating SSH configurations for git access.

An attacker who can supply or manipulate a repository URL processed by a go-git-based application crafts a path such as foo'$(id>/tmp/pwned)' - the embedded single quote terminates the shell's quoted region and the parenthesized command runs when the SSH server evaluates the exec string through /bin/bash. This scenario requires the target infrastructure to use a user account with a general login shell for SSH git access rather than the hardened git-shell configuration. No public proof-of-concept code has been identified at time of analysis.