{"id":"CVE-2026-5917","aliases":["ALPINE-CVE-2026-5917","BELL-CVE-2026-5917","DEBIAN-CVE-2026-5917","EUVD-2026-57011","GHSA-3gwr-xcwq-7892","GHSA-xqj4-2j5v-rr75","JLSEC-2026-1275","MGASA-2026-0570","OESA-2026-4621","OESA-2026-4622","OESA-2026-4623","UBUNTU-CVE-2026-5917","USN-8809-1","openSUSE-SU-2026:11521-1"],"status":"published","title":"libgit2 Shell Command Injection via ssh_libssh2 Backend","description":"libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01427,"percentile":0.73186,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-08-11T21:40:29Z","modified":"2026-11-03T06:33:03Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"libgit2","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libgit2","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libgit2","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libgit2","fixed_in":["1.9.7-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgit2","fixed_in":["1.5.1+ds-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgit2","fixed_in":["1.9.0+ds-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgit2","fixed_in":["1.9.7+ds-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibGit2_jll","fixed_in":["1.9.1+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libgit2","fixed_in":["1.7.2-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libgit2","fixed_in":["1.7.2-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libgit2","fixed_in":["1.7.2-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","fixed_in":["0.24.1-2ubuntu0.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libgit2","fixed_in":["0.26.0+dfsg.1-1.1ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libgit2","fixed_in":["0.28.4+dfsg.1-2ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libgit2","fixed_in":["1.1.0+dfsg.1-4.1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libgit2","fixed_in":["1.7.2+ds-1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libgit2","fixed_in":["1.9.1+ds-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libgit2","fixed_in":["1.9.7-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0-r2"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.1-r0"},{"fixed":"1.9.7-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1+ds-1+deb12u2"}]}],"versions":["1.5.1+ds-1","1.5.1+ds-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0+ds-2+deb13u1"}]}],"versions":["1.9.0+ds-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7+ds-1"}]}],"versions":["1.9.0+ds-2","1.9.1+ds-1","1.9.2+ds-1","1.9.2+ds-2","1.9.2+ds-3","1.9.2+ds-4","1.9.2+ds-5","1.9.2+ds-6","1.9.2+ds-7","1.9.2+ds-8","1.9.2+ds-9","1.9.3+ds-1","1.9.4+ds-1","1.9.6+ds-1"]},{"source":"osv","ecosystem":"Julia","package":"LibGit2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1.1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.1-2ubuntu0.2+esm4"}]}],"versions":["0.22.2-2","0.23.1-1","0.24.1-2","0.24.1-2ubuntu0.2","0.24.1-2ubuntu0.2+esm1","0.24.1-2ubuntu0.2+esm2","0.24.1-2ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0+dfsg.1-1.1ubuntu0.2+esm3"}]}],"versions":["0.25.1+really0.24.6-1","0.26.0+dfsg.1-1.1","0.26.0+dfsg.1-1.1build1","0.26.0+dfsg.1-1.1ubuntu0.2","0.26.0+dfsg.1-1.1ubuntu0.2+esm1","0.26.0+dfsg.1-1.1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.4+dfsg.1-2ubuntu0.1+esm2"}]}],"versions":["0.27.7+dfsg.1-0.2build1","0.28.3+dfsg.1-1","0.28.3+dfsg.1-1ubuntu1","0.28.4+dfsg.1-2","0.28.4+dfsg.1-2ubuntu0.1","0.28.4+dfsg.1-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+dfsg.1-4.1ubuntu0.1+esm2"}]}],"versions":["1.1.0+dfsg.1-4","1.1.0+dfsg.1-4.1","1.1.0+dfsg.1-4.1build1","1.1.0+dfsg.1-4.1ubuntu0.1","1.1.0+dfsg.1-4.1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2+ds-1ubuntu3.2"}]}],"versions":["1.5.1+ds-1ubuntu1","1.7.1+ds-2ubuntu1","1.7.2+ds-1ubuntu1","1.7.2+ds-1ubuntu2","1.7.2+ds-1ubuntu3","1.7.2+ds-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1+ds-1ubuntu1.2"}]}],"versions":["1.9.0+ds-2ubuntu2","1.9.1+ds-1ubuntu1","1.9.1+ds-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.1-2ubuntu0.2+esm4"}]}],"versions":["0.22.2-2","0.23.1-1","0.24.1-2","0.24.1-2ubuntu0.2","0.24.1-2ubuntu0.2+esm1","0.24.1-2ubuntu0.2+esm2","0.24.1-2ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0+dfsg.1-1.1ubuntu0.2+esm3"}]}],"versions":["0.25.1+really0.24.6-1","0.26.0+dfsg.1-1.1","0.26.0+dfsg.1-1.1build1","0.26.0+dfsg.1-1.1ubuntu0.2","0.26.0+dfsg.1-1.1ubuntu0.2+esm1","0.26.0+dfsg.1-1.1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.4+dfsg.1-2ubuntu0.1+esm2"}]}],"versions":["0.27.7+dfsg.1-0.2build1","0.28.3+dfsg.1-1","0.28.3+dfsg.1-1ubuntu1","0.28.4+dfsg.1-2","0.28.4+dfsg.1-2ubuntu0.1","0.28.4+dfsg.1-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+dfsg.1-4.1ubuntu0.1+esm2"}]}],"versions":["1.1.0+dfsg.1-4","1.1.0+dfsg.1-4.1","1.1.0+dfsg.1-4.1build1","1.1.0+dfsg.1-4.1ubuntu0.1","1.1.0+dfsg.1-4.1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2+ds-1ubuntu3.2"}]}],"versions":["1.5.1+ds-1ubuntu1","1.7.1+ds-2ubuntu1","1.7.2+ds-1ubuntu1","1.7.2+ds-1ubuntu2","1.7.2+ds-1ubuntu3","1.7.2+ds-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1+ds-1ubuntu1.2"}]}],"versions":["1.9.0+ds-2ubuntu2","1.9.1+ds-1ubuntu1","1.9.1+ds-1ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-1.1"}]}]}],"products":[{"vendor":"libgit2","product":"libgit2"}],"references":[{"url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-xqj4-2j5v-rr75","tags":["vendor-advisory","patch","fix"]},{"url":"https://www.vulncheck.com/advisories/libgit2-shell-command-injection-via-ssh-libssh2-backend","tags":["third-party-advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5917","tags":["advisory","web"]},{"url":"https://github.com/libgit2/libgit2","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-3gwr-xcwq-7892","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-5917","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-5917","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5917.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5917","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0570.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35993","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VHH635RSSSNGD55XOG7MSUBAC6CK77E2/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/20/4","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8628-1","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00364.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4621","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4622","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4623","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-5917","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5917","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8809-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5917","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-5917","title":"libgit2 Shell Command Injection via ssh_libssh2 Backend","description":"libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-11T21:40:29.078Z","modified":"2026-10-01T15:20:07.878Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:39:39.001586Z"}],"euvd":[{"id":"EUVD-2026-57011","description":"libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-11T21:40:29Z","modified":"2026-10-01T15:20:07Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:45.358437Z"}],"ghsa":[{"id":"GHSA-3gwr-xcwq-7892","title":"libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2)...","description":"libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-12T00:31:11Z","modified":"2026-08-26T18:30:55Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:10:59.276943Z"}],"nvd":[{"id":"CVE-2026-5917","description":"libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-11T22:17:37.39Z","modified":"2026-09-24T20:43:32.537Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:36.880938Z"}],"osv":[{"id":"ALPINE-CVE-2026-5917","description":"libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-11T22:17:37.39Z","modified":"2026-11-03T06:33:03.892107831Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-5917","status":"published","published":"2026-08-14T06:04:03.646828Z","modified":"2026-08-28T07:15:05.378778834Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-5917","title":"libgit2 Shell Command Injection via ssh_libssh2 Backend","description":"libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-11T21:40:29.078Z","modified":"2026-10-28T02:31:01.137382082Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-5917","description":"libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-11T22:17:37.39Z","modified":"2026-10-12T17:00:08.757328055Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"JLSEC-2026-1275","title":"libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2)...","description":"libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (`USE_SSH`=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The `gen_proto()` function in `ssh_libssh2.c` inserts the repository path directly into a shell command string without escaping special characters before passing it to `libssh2_channel_exec()`, enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-13T06:24:20.501Z","modified":"2026-08-13T06:43:43.837084312Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-4621","title":"libgit2 security update","description":"libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings.\r\n\r\nSecurity Fix(es):\n\nlibgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server\u0026apos;s shell to interpret injected commands under the victim\u0026apos;s SSH user account.(CVE-2026-5917)","status":"published","published":"2026-10-29T09:03:41Z","modified":"2026-10-29T09:15:40.269229679Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4622","title":"libgit2 security update","description":"libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings.\r\n\r\nSecurity Fix(es):\n\nlibgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server\u0026apos;s shell to interpret injected commands under the victim\u0026apos;s SSH user account.(CVE-2026-5917)","status":"published","published":"2026-10-29T09:03:42Z","modified":"2026-10-29T09:15:40.039459635Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4623","title":"libgit2 security update","description":"libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings.\r\n\r\nSecurity Fix(es):\n\nlibgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server\u0026apos;s shell to interpret injected commands under the victim\u0026apos;s SSH user account.(CVE-2026-5917)","status":"published","published":"2026-10-29T09:03:42Z","modified":"2026-10-29T09:15:43.253845073Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"UBUNTU-CVE-2026-5917","description":"libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.","status":"published","published":"2026-08-11T22:17:00Z","modified":"2026-09-24T07:30:38.038631325Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"MGASA-2026-0570","title":"Updated libgit2 package fixes security vulnerabilities","description":"Inverted IP SubjectAltName Comparison in OpenSSL Backend.\n(CVE-2026-53583)\nSubmodule path traversal. (CVE-2026-53584)\nUnbounded Memory Allocation via Delta Object Result-Size Header.\n(CVE-2026-53585)\nHTTP transport can leak credentials to an offsite redirect target.\n(CVE-2026-53586)\nUnauthenticated network-reachable heap out-of-bounds read in\ntransports/smart_pkt.c:set_data. (CVE-2026-53587)\nShell Command Injection via ssh_libssh2 Backend. (CVE-2026-5917)\n","status":"published","published":"2026-10-30T15:30:36Z","modified":"2026-10-30T15:45:02.524280865Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11521-1","title":"libgit2-1_9-1.9.7-1.1 on GA media","description":"These are all security issues fixed in the libgit2-1_9-1.9.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:04.215150822Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"USN-8809-1","title":"libgit2 vulnerability","description":"Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly\nhandled certain repository URLs when using the SSH transport. A remote\nattacker could possibly use this issue to execute arbitrary commands.","status":"published","published":"2026-09-23T18:29:41Z","modified":"2026-09-24T07:42:33.639154454Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}