Shell Command Injection Vulnerability in libgit2: CVE-2026-5917
Summary
DEBIAN-CVE-2026-5917: libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by... Affects libgit2 versions 1.1.0+dfsg.1-4 – 1.9.6+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant library with a solid API. It is widely used in various applications for version control and repository management. This library supports multiple backends for SSH connections, including libssh2. The vulnerability in question affects versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend, exposing users to potential command injection attacks.
Vulnerability Detail
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend contain a shell command injection vulnerability. This flaw allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path with unescaped shell metacharacters such as single quotes, semicolons, or pipes. The vulnerability originates from the gen_proto() function in ssh_libssh2.c, which inserts the repository path directly into a shell command string without proper escaping. This can lead to malicious submodule URLs in .gitmodules files, which, when processed during a recursive clone, can cause the remote server's shell to interpret injected commands under the victim's SSH user account.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using repository paths that contain shell metacharacters when working with libgit2. This can help mitigate the risk of command injection until a patch is applied.
Conclusion
The shell command injection vulnerability in libgit2 (CVE-2026-5917) poses a significant risk to users utilizing versions v0.27.0 through v1.9.0 with the libssh2 SSH backend. It is crucial to update to a patched version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for libgit2 →
FAQ
CVE-2026-5917 is a vulnerability in libgit2 that allows remote attackers to execute arbitrary commands on an SSH server through shell command injection.
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary measure, avoid using repository paths with shell metacharacters to reduce the risk of exploitation until you can apply the patch.
More details can be found in the official CVE database or by referring to the Debian security advisories related to libgit2.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
