CVE-2026-5917

Received Received - Intake

Command Injection in libgit2 via SSH Submodule URLs

Publication date: 2026-08-11

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-5917

EUVD

EUVD-2026-57011

Affected Vendors & Products

Vendor	Product	Version / Range
libgit2	libgit2	From 0.27.0 (inc) to 1.9.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects libgit2 versions v0.27.0 through v1.9.0 when built with the libssh2 SSH backend. It allows remote attackers to execute arbitrary commands on an SSH server by injecting shell metacharacters like single quotes, semicolons, or pipes into a repository path. The issue occurs because the gen_proto() function in ssh_libssh2.c does not escape special characters before passing the path to libssh2_channel_exec(). Attackers can exploit this by crafting a malicious submodule URL in a .gitmodules file, which triggers command execution during a recursive clone under the victim's SSH user account.

Detection Guidance

Check if your system uses libgit2 with the libssh2 backend by inspecting installed versions and build configurations. Look for vulnerable versions between v0.27.0 and v1.9.0. Review .gitmodules files in repositories for unescaped shell metacharacters like single quotes, semicolons, or pipes.

Impact Analysis

If you use a vulnerable version of libgit2 with the libssh2 backend, an attacker could execute arbitrary commands on your SSH server by tricking you into cloning a repository with a malicious .gitmodules file. This could lead to unauthorized access, data theft, or system compromise under your SSH user account. The attack requires user interaction, such as cloning a repository, but could have severe consequences if successful.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (e.g., unauthorized data processing) or HIPAA (e.g., unauthorized access to protected health information). Organizations using vulnerable libgit2 versions may face legal penalties, reputational damage, or loss of certification if such an incident occurs.

Mitigation Strategies

Upgrade libgit2 to a version beyond v1.9.0 where the issue is fixed. Disable the libssh2 backend if not required. Audit repositories for malicious .gitmodules files and remove any suspicious submodule URLs. Restrict SSH user permissions to limit command execution impact.

Hi! I’m here to help you understand CVE-2026-5917. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70