Loading vulnerability…
Shell Command Injection in libgit2's libssh2 SSH Backend
CVE-2026-5917 is a shell command injection vulnerability in libgit2 releases before 1.8.7 and in the 1.9 series before 1.9.7 when built with the libssh2 SSH backend. The gen_proto() function places a repository path inside a single-quoted shell command without properly escaping embedded special characters, then passes the command to libssh2_channel_exec(). An attacker-controlled path can break out of the quoting and inject commands. A crafted SSH submodule URL processed during a recursive clone can trigger arbitrary command execution on the remote SSH server under the victim's authenticated SSH account.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the remote SSH account used by the victim's libgit2 application. Injected commands can read or modify data and disrupt services accessible to that account. Execution occurs on the SSH server, not inherently on the client running libgit2, and does not automatically grant privileges beyond those of the authenticated account.
If you can’t patch tonight, do this now.
Until patched, avoid recursive cloning of untrusted repositories and inspect submodule URLs before allowing SSH-based submodule operations. Avoid processing other untrusted SSH repository URLs through affected applications. Where operationally feasible, disable the libssh2 SSH backend or use an alternative backend not affected by this flaw.
Patch, then assume compromise.
Upgrade libgit2 to 1.8.7 or later in the 1.8 branch, or 1.9.7 or later in the 1.9 branch, or install a vendor package containing the backported fix. Fixed Debian packages include 1.5.1+ds-1+deb12u2 for Debian 12 and 1.9.0+ds-2+deb13u1 for Debian 13. The correction escapes remote repository paths before constructing SSH commands. Rebuild or replace applications that statically bundle vulnerable libgit2, including affected Rust applications using libgit2-sys; updating only the system library does not correct an embedded copy.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.