SB2026081713 - Fedora EPEL 10.2 update for libgit2_1.9

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081713

SB2026081713 - Fedora EPEL 10.2 update for libgit2_1.9

Published: August 17, 2026

Security Bulletin ID SB2026081713
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) OS Command Injection (CVE-ID: CVE-2026-5917)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary commands on the SSH server.

The vulnerability exists due to command injection in the libssh2 SSH backend gen_proto() function when processing a repository path containing an unescaped single quote. A remote attacker can supply a specially crafted SSH repository URL or submodule URL to execute arbitrary commands on the SSH server.

User interaction is required to clone or update content referencing the crafted SSH URL, and exploitation requires the target SSH account to use an ordinary login shell rather than a restricted command handler.


Remediation

Install update from vendor's website.

References