GO-2026-6182 Command execution via PowerShell smart quotes in github.com/rclone/rclone

PowerShell treats several Unicode smart-quote characters U+2018, U+2019, U+201A, U+201B as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename wit...

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

Summary rclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and...

CVE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...