rclone Go Package Vulnerability: PowerShell Smart-Quote Injection
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- <= 1.74.4
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the rclone Go package that could allow an attacker to inject PowerShell commands via smart-quote filenames.
What happened
The rclone Go package reportedly interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and append PowerShell statements executed as the victim's SSH account.
This vulnerability is under investigation and has not been exploited in the wild. The issue affects rclone versions up to and including 1.74.4. The vulnerability has been tracked under the ID GHSA-2M8M-JHRM-W6J2.
What to do about it
- Monitor the rclone project for updates and announcements regarding a fix.
- Review any SFTP paths used in your environment to assess potential exposure.
- Upgrade to the latest version of rclone once a fix is available.
- Consider implementing additional validation or sanitization for SFTP paths to mitigate potential risks.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using rclone Go package version 1.74.4 or earlier.
What should I do right now?
Monitor the rclone project for updates and announcements regarding a fix. Review any SFTP paths used in your environment to assess potential exposure.
Has a fix been released?
No official fix has been published yet. Monitor the sources below for updates.