CVE-2026-5917
Fixed in a distro release EPSS 1%CVSS 8.8
libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.
Products: libgit2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | cargo-c | 0.10.21-1.amzn2023.0.2 |
| Amazon Linux 2023 | libgit2 | 1.6.4-116.amzn2023 |
| Amazon Linux 2023 | libgit2-devel | 1.6.4-116.amzn2023 |
| Debian 12 | libgit2 | 1.5.1+ds-1+deb12u2 |
| Debian 13 | libgit2 | 1.9.0+ds-2+deb13u1 |
| Debian 14 | libgit2 | 1.9.7+ds-1 |
| Ubuntu 24.04 LTS | libgit2 | 1.7.2+ds-1ubuntu3.2 |
| Ubuntu 26.04 LTS | libgit2 | 1.9.1+ds-1ubuntu1.2 |
| Ubuntu Pro 16.04 LTS | libgit2 | 0.24.1-2ubuntu0.2+esm4 |
| Ubuntu Pro 18.04 LTS | libgit2 | 0.26.0+dfsg.1-1.1ubuntu0.2+esm3 |
| Ubuntu Pro 20.04 LTS | libgit2 | 0.28.4+dfsg.1-2ubuntu0.1+esm2 |
| Ubuntu Pro 22.04 LTS | libgit2 | 1.1.0+dfsg.1-4.1ubuntu0.1+esm2 |
| openSUSE Tumbleweed | libgit2 | 1.9.7-1.1 |