libgit2 SSH Backend Flaw Enables Shell Command Injection During Recursive Clone
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 12, 2026
A shell command injection vulnerability tracked as CVE-2026-5917 affects libgit2 versions 0.27.0 through 1.9.0 when the library is built with the libssh2 SSH backend using USE_SSH=libssh2. The flaw is in the gen_proto() function in ssh_libssh2.c, which inserts a repository path into a shell command without escaping shell metacharacters before passing it to libssh2_channel_exec(). The issue is classified as CWE-78 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
Attackers can exploit the bug by supplying a malicious repository path containing characters such as quotes, semicolons, or pipes, including through a crafted submodule URL in a .gitmodules file during a recursive clone. If triggered, the SSH server's shell may execute attacker-injected commands under the victim's SSH user account, creating a path to full compromise of confidentiality, integrity, and availability in affected environments.
