OS Command Injection in Rsync - CVE-2026-53790
Published: August 13, 2026
Vulnerability identifier: #VU142289
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53790
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to improper neutralization of special elements in shell commands and command arguments in rsync command construction and helper invocation when processing peer- or host-controlled values. A remote attacker can supply specially crafted host, environment, hostspec, or remote path values to execute arbitrary commands.
The issue affects multiple injection sinks, including RSYNC_CONNECT_PROG host substitution, daemon exec hook expansion, rsync-ssl helper invocation, and remote-shell argument quoting for newline or carriage return characters.
Affected software
Rsync
How to mitigate CVE-2026-53790
Install security update from vendor's website.
Rsync - update to 3.5.0