Loading story…
A shell command injection vulnerability tracked as CVE-2026-5917 affects libgit2 versions 0.27.0 through 1.9.0 when the library is built with the libssh2 SSH backend using USE_SSH=libssh2. The flaw is in the gen_proto() function in ssh_libssh2.c, which inserts a repository path into a shell command without escaping shell metacharacters before passing it to libssh2_channel_exec(). The issue is classified as CWE-78 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
Attackers can exploit the bug by supplying a malicious repository path containing characters such as quotes, semicolons, or pipes, including through a crafted submodule URL in a .gitmodules file during a recursive clone. If triggered, the SSH server's shell may execute attacker-injected commands under the victim's SSH user account, creating a path to full compromise of confidentiality, integrity, and availability in affected environments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-5917 states that the new CVE was received by disclosure@vulncheck.com on August 11, 2026. The entry identifies the issue as a shell command injection in libgit2's ssh_libssh2 backend affecting versions 0.27.0 through 1.9.0.
VulnCheck disclosed a shell command injection vulnerability affecting libgit2 versions 0.27.0 through 1.9.0 when built with the libssh2 SSH backend. The advisory described the root cause in ssh_libssh2.c and noted exploitation via malicious repository paths or crafted submodule URLs during recursive clone operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2025-48384** affects Git’s handling of configuration values containing trailing carriage returns, creating a path for unintended script execution during submodule initialization. According to Armis, the flaw can be abused when an attacker can influence the relevant configuration context, potentially turning routine clone or submodule operations into code execution. Microsoft’s Security Update Guide also lists the issue, identifying it as a Git/GitHub vulnerability. Public exploit activity quickly followed disclosure, with multiple GitHub repositories publishing proof-of-concept material for **CVE-2025-48384**, including variants described as working over HTTPS and others explicitly labeling the issue as carriage-return-driven remote code execution on cloning. The appearance of several PoC repositories indicates that exploit details are broadly accessible, increasing the likelihood of weaponization against developers and build environments that process untrusted repositories or submodules.
Jun 29, 2026
libgit2 released security fixes in versions **1.9.5** and **1.9.7** to address multiple vulnerabilities affecting HTTP authentication, smart packet parsing, submodule handling, TLS certificate validation, regex processing, delta handling, and SSH transport escaping. The most serious issues include **CVE-2026-53587**, a heap out-of-bounds read in `smart_pkt.c` triggered by malformed capability data, and **CVE-2026-53584**, a submodule path traversal flaw that could create directories outside a repository working tree. Other patched issues include **CVE-2026-53586** for credential leakage across redirected HTTP hosts, **CVE-2026-53585** for unbounded memory allocation that can cause denial of service, and **CVE-2026-53583** for incorrect IP `SubjectAltName` verification in the OpenSSL backend that could enable man-in-the-middle attacks. Project commits show the packet-parsing fix added explicit length checks before comparing the `object-format=` capability, preventing `strncmp` from reading past truncated packet data; equivalent patches were applied on the main, `v1.9.7`, and `v1.8` maintenance lines. The **1.9.5** release also fixed a heap buffer overflow in bundled **PCRE** reachable through revspec parsing and an error-handling flaw in blame hunk creation, while **1.9.7** additionally addressed **CVE-2026-5917**, a libssh2 transport escaping issue that could lead to command injection. Users on the **v1.8** branch were advised to move to **1.8.6** or **1.8.7**, which are believed to contain corresponding fixes.
Aug 20, 2026
A pseudonymous researcher publicly released a proof-of-concept exploit for **CVE-2026-55200**, a **pre-authentication remote code execution** flaw in `libssh2`, as part of a larger GitHub dump of more than 30 zero-day exploits affecting open-source software. Reporting on the release said the `libssh2` issue was independently verified, assigned a **CVSS 9.2**, and described as being under active exploitation, intensifying concern because the disclosure bypassed coordinated vulnerability reporting and exposed defenders before maintainers had broadly completed remediation. Technical advisories identified the bug as an **out-of-bounds write** caused by an unchecked `packet_length` value in `transport.c`, and national CERT guidance later included it among SSH-related product vulnerabilities. The combined disclosures indicate that systems using vulnerable `libssh2` builds may be exposed to unauthenticated compromise over SSH-related communications, prompting organizations to urgently inventory affected software, apply vendor fixes as they become available, and monitor for exploitation tied to malformed transport-layer packets.
Aug 16, 2026