OS Command Injection in libgit2 - CVE-2026-5917

Vulnerability identifier: #VU143594

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-5917

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the SSH server.

The vulnerability exists due to command injection in the libssh2 SSH backend gen_proto() function when processing a repository path containing an unescaped single quote. A remote attacker can supply a specially crafted SSH repository URL or submodule URL to execute arbitrary commands on the SSH server.

User interaction is required to clone or update content referencing the crafted SSH URL, and exploitation requires the target SSH account to use an ordinary login shell rather than a restricted command handler.

libgit2
Debian Linux
Fedora
Ubuntu
Anolis OS
rust-pretty-git-prompt
rust-git-delta
libgit2 (Ubuntu package)
rust-bat
rust-lsd
libgit2 (Debian package)
libgit2-devel
libgit2
libgit2-doc
libgit2_1.9
rust-git-interactive-rebase-tool
rust-tokei

Install security update from vendor's website.

libgit2 - addressed in versions 1.8.7, 1.9.7
rust-pretty-git-prompt - addressed in versions 0.2.2-11.fc43, 0.2.2-11.fc44
rust-git-delta - addressed in versions 0.19.1-7.el9, 0.19.1-7.el10_3, 0.19.1-7.fc43, 0.19.1-7.fc44
libgit2 (Ubuntu package) - addressed in versions 0.24.1-2ubuntu0.2+esm4, 0.26.0+dfsg.1-1.1ubuntu0.2+esm3, 0.28.4+dfsg.1-2ubuntu0.1+esm2, 1.1.0+dfsg.1-4.1ubuntu0.1+esm2, 1.7.2+ds-1ubuntu3.2, 1.9.1+ds-1ubuntu1.2
rust-bat - addressed in versions 0.26.1-2.el9, 0.26.1-3.el10_3, 0.26.1-3.fc43, 0.26.1-3.fc44
rust-lsd - addressed in versions 1.2.0-8.el9, 1.2.0-8.el10_2, 1.2.0-8.el10_3, 1.2.0-8.fc43, 1.2.0-8.fc44
libgit2 (Debian package) - update to 1.9.0+ds-2+deb13u1
libgit2-devel - update to 1.9.7-1
libgit2 - update to 1.9.7-1
libgit2-doc - update to 1.9.7-1
libgit2_1.9 - addressed in versions 1.9.7-1.el9, 1.9.7-1.el10_2, 1.9.7-1.el10_3
rust-git-interactive-rebase-tool - addressed in versions 2.4.1-17.fc43, 2.4.1-17.fc44
rust-tokei - addressed in versions 14.0.0-7.el9, 14.0.0-7.el10_3, 14.0.0-7.fc43, 14.0.0-7.fc44

• https://github.com/libgit2/libgit2/security/advisories/GHSA-qqwh-747c-fpx2
• https://github.com/libgit2/libgit2/security/advisories/GHSA-xqj4-2j5v-rr75

• OS Command Injection in libgit2
• Fedora EPEL 10.3 update for libgit2_1.9
• Fedora EPEL 9 update for libgit2_1.9
• Fedora EPEL 10.2 update for libgit2_1.9
• Fedora EPEL 10.3 update for rust-bat, rust-git-delta, rust-lsd, rust-tokei
• Fedora 44 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
• Fedora 43 update for rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei
• Fedora EPEL 9 update for rust-bat, rust-git-delta, rust-lsd, rust-tokei
• Fedora EPEL 10.2 update for rust-lsd
• Debian update for libgit2
• Anolis OS update for libgit2
• Ubuntu update for libgit2