Skip to main content

libgit2 CVE-2026-5917

| EUVDEUVD-2026-57011 HIGH
OS Command Injection (CWE-78)
2026-08-11 disclosure@vulncheck.com GHSA-3gwr-xcwq-7892
Command Injection
8.6
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
8.6 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Network-reachable via SSH, no attacker privileges needed, but user must initiate recursive clone; scope changes because injection impacts remote SSH server beyond the vulnerable libgit2 process.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

6
Analysis Updated
Aug 26, 2026 - 16:32 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 26, 2026 - 16:22 vuln.today
cvss_changed
Severity Changed
Aug 26, 2026 - 16:22 NVD
CRITICAL HIGH
CVSS changed
Aug 26, 2026 - 16:22 NVD
9.4 (CRITICAL) 8.6 (HIGH)
Analysis Generated
Aug 11, 2026 - 22:41 vuln.today
CVE Published
Aug 11, 2026 - 22:17 cve.org
CRITICAL 9.4

DescriptionCVE.org

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.

AnalysisAI

Shell command injection in libgit2's SSH libssh2 backend (v0.27.0-v1.9.0) enables remote attackers to execute arbitrary commands on an SSH server by embedding unescaped shell metacharacters in a submodule URL. An attacker who controls a repository's .gitmodules file can induce arbitrary SSH server-side code execution under the victim's SSH user account when the victim performs a recursive clone using a libgit2-based client built with the libssh2 backend. No public exploit has been identified at time of analysis and SSVC assessment records no active exploitation, but CVSS 4.0 scores this 8.6 and technical impact is rated total.

Technical ContextAI

libgit2 is a portable C implementation of the Git core library used by many Git clients and hosting platforms. The vulnerability is rooted in CWE-78 (OS Command Injection): the gen_proto() function in ssh_libssh2.c constructs a shell command by concatenating the repository path directly into a string (e.g., git-upload-pack '/path/to/repo'), which is then dispatched via libssh2_channel_exec(). When the repository path contains shell metacharacters-single quotes, semicolons, pipes-the remote SSH server's shell interprets the injected tokens as additional commands rather than path components. The vulnerability is specific to builds compiled with USE_SSH=libssh2; builds using other SSH backends (e.g., OpenSSH exec transport) are not affected. Affected CPE range covers libgit2 0.27.0 through 1.9.0 per EUVD-2026-57011.

RemediationAI

Upgrade to a patched release of libgit2 beyond v1.9.0; the vendor has confirmed a patch is available per the GitHub Security Advisory at https://github.com/libgit2/libgit2/security/advisories/GHSA-xqj4-2j5v-rr75, though no specific fixed version number is confirmed in the available intelligence-verify the exact patched release tag against the upstream repository at https://github.com/libgit2/libgit2. If an immediate upgrade is not feasible, recompile libgit2 without the libssh2 backend (omit USE_SSH=libssh2 or select an alternative SSH transport) to eliminate the vulnerable code path entirely; this may remove SSH functionality if no other backend is substituted. As an additional control, restrict recursive clone operations to trusted repositories in CI/CD pipelines, enforcing allowlists of permitted submodule hosts and blocking execution on repositories with untrusted .gitmodules files. Do not perform git clone --recurse-submodules against untrusted or third-party repositories using affected libgit2 builds until patched.

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-5917 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy