OS Command Injection in libgit2 - CVE-2026-5917

Vulnerability identifier: #VU143594

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-5917

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the SSH server.

The vulnerability exists due to command injection in the libssh2 SSH backend gen_proto() function when processing a repository path containing an unescaped single quote. A remote attacker can supply a specially crafted SSH repository URL or submodule URL to execute arbitrary commands on the SSH server.

User interaction is required to clone or update content referencing the crafted SSH URL, and exploitation requires the target SSH account to use an ordinary login shell rather than a restricted command handler.

libgit2
Fedora
rust-pretty-git-prompt
rust-git-delta
rust-bat
rust-lsd
libgit2_1.9
rust-git-interactive-rebase-tool
rust-tokei

Install security update from vendor's website.

libgit2 - addressed in versions 1.8.7, 1.9.7
rust-pretty-git-prompt - addressed in versions 0.2.2-11.fc43, 0.2.2-11.fc44
rust-git-delta - addressed in versions 0.19.1-7.el9, 0.19.1-7.el10_3, 0.19.1-7.fc43, 0.19.1-7.fc44
rust-bat - addressed in versions 0.26.1-2.el9, 0.26.1-3.el10_3, 0.26.1-3.fc43, 0.26.1-3.fc44
rust-lsd - addressed in versions 1.2.0-8.el9, 1.2.0-8.el10_2, 1.2.0-8.el10_3, 1.2.0-8.fc43, 1.2.0-8.fc44
libgit2_1.9 - addressed in versions 1.9.7-1.el9, 1.9.7-1.el10_2, 1.9.7-1.el10_3
rust-git-interactive-rebase-tool - addressed in versions 2.4.1-17.fc43, 2.4.1-17.fc44
rust-tokei - addressed in versions 14.0.0-7.el9, 14.0.0-7.el10_3, 14.0.0-7.fc43, 14.0.0-7.fc44

• https://github.com/libgit2/libgit2/security/advisories/GHSA-qqwh-747c-fpx2
• https://github.com/libgit2/libgit2/security/advisories/GHSA-xqj4-2j5v-rr75

• OS Command Injection in libgit2
• Fedora EPEL 10.3 update for libgit2_1.9
• Fedora EPEL 9 update for libgit2_1.9
• Fedora EPEL 10.2 update for libgit2_1.9
• Fedora EPEL 10.3 update for rust-bat, rust-git-delta, rust-lsd, rust-tokei
• Fedora 44 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
• Fedora 43 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
• Fedora EPEL 9 update for rust-bat, rust-git-delta, rust-lsd, rust-tokei
• Fedora EPEL 10.2 update for rust-lsd