High [CVE-2026-5917] Arbitrary code execution via shell command injection in SSH backend
This high-severity Red Hat Linux advisory covers CVE-2026-5917 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes.
The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a.gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.
By crafting a malicious repository path containing unescaped shell metacharacters, an attacker can inject commands that are then interpreted by the remote server's shell during operations like a recursive clone. This could lead to arbitrary code execution under the victim's SSH user account.
This is an Important flaw. Red Hat products utilizing libgit2 with the libssh2 SSH backend are susceptible to remote arbitrary code execution.
Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-78.
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- To mitigate this issue, avoid cloning Git repositories from untrusted sources, especially those containing submodules. If possible, disable automatic recursive cloning of submodules when working with potentially untrusted repositories. Ensure that SSH user accounts used for cloning have minimal necessary privileges to limit the impact of successful exploitation.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.