CVE-2026-5917: libgit2 v0.27.0-v1.9.0 Shell Command Injection via ssh_libssh2 Backend
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USESSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The genproto() function in sshlibssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2channelexec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in v0.27.0-v1.9.0Patch Shell Command Injection via ssh_libssh2 Backend - Configuration
Do not use the libssh2 SSH backend (USE_SSH=libssh2), since libgit2 versions v0.27.0 through v1.9.0 built with USE_SSH=libssh2 contain a shell command injection vulnerability. Use a non-libssh2 SSH backend instead.
libgit2 (USE_SSH=libssh2) USE_SSH = libssh2 disabled / non-libssh2 - Compensating control
If recursive clone processing of attacker-controlled .gitmodules files is possible, prevent untrusted repository path values (that could include shell metacharacters like single quotes, semicolons, or pipes) from being used in libgit2 operations performed with the libssh2 backend.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5917?
CVE-2026-5917 has a critical severity rating of 9.6.
How do I fix CVE-2026-5917?
To mitigate CVE-2026-5917, upgrade libgit2 to version 1.9.1 or later.
What causes the CVE-2026-5917 vulnerability?
CVE-2026-5917 is caused by a shell command injection vulnerability in libgit2 when using the libssh2 backend.
Who is affected by CVE-2026-5917?
All users of libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend are affected by CVE-2026-5917.
Can CVE-2026-5917 lead to remote code execution?
Yes, CVE-2026-5917 allows remote attackers to execute arbitrary commands on an SSH server.