EUVD-2026-80878Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network SSH transport (AV:N); dependent on a shell-based server and shell-tailored path (AC:H); runs within an authenticated SSH session (PR:L); arbitrary command execution as the SSH user yields full C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters not neutralized by the active IRemotePathTransformation can execute commands as the authenticated SSH user. Exploitation requires a shell-based server and a path crafted for that shell's parsing rules; non-shell servers and paths fully neutralized by the selected transformation are not affected. RemotePathTransformation.ShellQuote is available for POSIX shells, while SftpClient avoids a remote shell entirely. This issue is fixed in version 2026.0.0.
AnalysisAI
Command injection in SSH.NET's ScpClient (Renci.SshNet, all releases prior to 2026.0.0) lets a remote attacker who can influence the remote path supplied by a calling application execute arbitrary commands as the authenticated SSH user on a shell-based server. The default RemotePathTransformation.DoubleQuote cannot safely quote every remote command interpreter, so shell metacharacters that survive the transformation are parsed by the server's shell when the scp command line is assembled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following must hold: the application uses ScpClient (not SftpClient, which avoids a remote shell entirely); it passes an attacker-controlled or otherwise untrusted remote path; the active IRemotePathTransformation does not fully neutralize the path for the target shell - specifically the default RemotePathTransformation.DoubleQuote, which cannot safely quote every remote command interpreter; the target SSH server is shell-based; and the path is crafted for that shell's parsing rules. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-exploitable command injection (CWE-78) in SSH.NET's ScpClient, not an inflated high-CVSS finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade SSH.NET to 2026.0.0 (https://github.com/sshnet/SSH.NET/releases/tag/2026.0.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all applications and services that use Renci.SshNet or SSH.NET ScpClient, confirm whether any version prior to 2026.0.0 is deployed, and determine whether external or untrusted input can influence the remote path; where ScpClient is not essential, disable or block its use, and where it is essential, require a fully neutralizing transformation such as ShellQuote for POSIX shells or migrate the workflow to SftpClient. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today