CVE-2026-53790: rsync < 3.5.0 Command Injection via Multiple Code Paths
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53790?
The severity of CVE-2026-53790 is rated high with a score of 8.1.
How do I fix CVE-2026-53790?
To fix CVE-2026-53790, upgrade to rsync version 3.5.0 or later.
What types of vulnerabilities are associated with CVE-2026-53790?
CVE-2026-53790 is associated with command and argument injection vulnerabilities.
What software is affected by CVE-2026-53790?
The affected software is rsync, specifically versions before 3.5.0.
What can attackers achieve by exploiting CVE-2026-53790?
Attackers can execute arbitrary commands by supplying malicious input through various code paths.