Shell Command Injection Vulnerability in libgit2 by libssh2
CVE-2026-5917

9.4CRITICAL

Key Information:

Vendor

Libgit2

Status
Libgit2
Vendor
CVE Published:
11 August 2026

What is CVE-2026-5917?

A vulnerability has been identified in libgit2 versions v0.27.0 through v1.9.0 when built with libssh2. The gen_proto() function in ssh_libssh2.c processes repository paths without proper escaping of special shell characters. This oversight allows remote attackers to inject commands into the SSH server during operations like recursive clones, potentially executing arbitrary shell commands under the victim’s SSH user account. Attackers may craft malicious submodule URLs in the .gitmodules file, leveraging unescaped characters such as single quotes, semicolons, or pipes to exploit this vulnerability.

Affected Version(s)

libgit2 0.27.0 <= 1.9.0

References

https://github.com/libgit2/libgit2
product
https://www.vulncheck.com/advisories/libgit2-shell-comman...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
.