Command Injection Vulnerability in SSH.NET Library for .NET

CVE-2026-85756

What is CVE-2026-85756?

The SSH.NET library, a Secure Shell (SSH) implementation for .NET, has a vulnerability in versions prior to 2026.0.0 related to the ScpClient component. The vulnerability arises because it incorrectly handles user-supplied remote paths when executing commands on shell-based servers. The default path transformation mechanism, RemotePathTransformation.DoubleQuote, fails to adequately neutralize shell metacharacters, allowing an attacker to inject malicious code that could be executed with the privileges of the authenticated SSH user. Thus, attackers could potentially exploit this issue on a shell-based server by providing a crafted input that adheres to the server's parsing rules. It’s noteworthy that deployments not using a shell-based server or using paths that are fully sanitized by the appropriate transformation are not impacted. For enhanced security, users are encouraged to upgrade to version 2026.0.0 or later where this issue is resolved.

References