SB20260816530 - OS Command Injection in libgit2

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: CVE-2026-5917)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary commands on the SSH server.

The vulnerability exists due to command injection in the libssh2 SSH backend gen_proto() function when processing a repository path containing an unescaped single quote. A remote attacker can supply a specially crafted SSH repository URL or submodule URL to execute arbitrary commands on the SSH server.

User interaction is required to clone or update content referencing the crafted SSH URL, and exploitation requires the target SSH account to use an ordinary login shell rather than a restricted command handler.

Remediation

Install update from vendor's website.

References

• https://github.com/libgit2/libgit2/security/advisories/GHSA-qqwh-747c-fpx2
• https://github.com/libgit2/libgit2/security/advisories/GHSA-xqj4-2j5v-rr75