Command and argument injection in rsync via unquoted peer- or host-controlled values (CVE-2026-53790)

rsync contains multiple injection vulnerabilities across four code paths - the RSYNC_CONNECT_PROG environment variable host substitution, daemon exec hook expansions, rsync-ssl hostspec handling, and remote-shell newline injection - where unsanitized user-supplied or peer-controlled values are passed into shell commands or command-line arguments without proper quoting or validation. Successful exploitation allows an attacker to execute arbitrary commands under the privileges of the rsync process or the invoking user. Affected versions: - <= 3.4.4 We recommend updating to: 3.5.0. CVSS 9.2 · our assessment: act_now Reference: https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq Details: https://vuln.today/cve/CVE-2026-53790