Izzy0101010101

**Name of the Vulnerable Software and Affected Versions** libgit2 versions 0.27.0 through 1.9.0 **Description** Remote attackers can execute arbitrary commands on an SSH server when the software is built with the libssh2 SSH backend (`USE SSH=libssh2`). The issue occurs because the `gen proto()` function in `ssh libssh2.c` inserts the repository path directly into a shell command string without escaping special characters before passing it to `libssh2 channel exec()`. An attacker can exploit this by crafting a malicious submodule URL in a `.gitmodules` file; when processed during a recursive clone, the remote server's shell interprets the injected shell metacharacters, such as single quotes, semicolons, or pipes, executing commands under the victim's SSH user account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.