—
GO-2026-6182
Command execution via PowerShell smart quotes in github.com/rclone/rclone
빠른 조치
GO-2026-6182 — github.com/rclone/rclone: 아래 명령으로 수정 버전으로 올리세요.
go get github.com/rclone/rclone@v1.75.0상세
PowerShell treats several Unicode smart-quote characters (U+2018, U+2019, U+201A, U+201B) as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename with smart quotes that closes the path literal and injects arbitrary PowerShell commands executed on the SFTP remote as the victim's SSH account.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.