CVE-2026-53790
Received Received - Intake

Command Injection Vulnerabilities in Rsync

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53790
EUVD
EUVD-2026-58098

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53790 is a command injection vulnerability in rsync versions before 3.5.0. It allows attackers to execute arbitrary commands by injecting shell metacharacters or newline characters into unsanitized inputs like hostnames or hostspecs. The flaws exist in multiple code paths including RSYNC_CONNECT_PROG, daemon hooks, rsync-ssl wrapper, and remote-shell command handling.

Detection Guidance

Check rsync version with 'rsync --version' to confirm if it is below 3.5.0. Inspect environment variables like RSYNC_CONNECT_PROG for suspicious values. Monitor logs for unexpected command execution or shell metacharacters in hostnames or paths.

Impact Analysis

This vulnerability allows attackers to run arbitrary commands on systems running vulnerable rsync versions. Attackers could gain control of the rsync process or the user account running it, potentially leading to data theft, system compromise, or further network infiltration. The impact depends on the privileges of the rsync process.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information. Organizations using vulnerable rsync versions may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Disable rsync daemon mode if not needed. Avoid using untrusted hostnames or paths in rsync commands. Review and sanitize environment variables like RSYNC_CONNECT_PROG.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53790. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart