CVE-2026-5917

Name of the Vulnerable Software and Affected Versions libgit2 versions 0.27.0 through 1.9.0

Description Remote attackers can execute arbitrary commands on an SSH server when the software is built with the libssh2 SSH backend (USE SSH=libssh2). The issue occurs because the gen proto() function in ssh libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2 channel exec(). An attacker can exploit this by crafting a malicious submodule URL in a .gitmodules file; when processed during a recursive clone, the remote server's shell interprets the injected shell metacharacters, such as single quotes, semicolons, or pipes, executing commands under the victim's SSH user account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.