A critical (CVSS 9.6) command injection flaw in libgit2 lets an attacker-controlled repository path execute arbitrary commands on the remote SSH server under the victim's account, triggered by something as routine as a recursive clone.
What Is It
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability (CWE-78). The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before handing it to libssh2_channel_exec(). A path containing unescaped shell metacharacters, single quotes, semicolons, pipes, is interpreted by the remote server's shell rather than treated as data.
Why It Matters
The CVSS 3.1 score of 9.6 CRITICAL (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and the secondary CVSS 4.0 score of 9.4 both come from VulnCheck, the source of the CVE record. NVD has not independently analyzed or scored this CVE, its record remains in Received status, so these are the assigning source's numbers, not an NVD assessment. Network attack vector, low complexity, no privileges required, and, notably; a changed scope: the injected commands run on the SSH server, not the client that parsed the malicious input.
The delivery path is the dangerous part. An attacker crafts a malicious submodule URL in a .gitmodules file. When a victim performs a recursive clone, libgit2 processes that submodule and the poisoned path reaches the remote shell, executing arbitrary commands under the victim's SSH user account. User interaction is required, but "clone a repository with submodules" is a low bar to clear.
What's Vulnerable
- Product: libgit2 (vendor: libgit2)
- Affected versions: v0.27.0 through v1.9.0 inclusive
- Required condition: built with the libssh2 SSH backend (
USE_SSH=libssh2)
Builds using a different SSH backend are outside the stated affected configuration. Note that libgit2 is an embedded library; exposure extends to any application, language binding, or tooling that links a vulnerable build.
Patch Status
The supplied source material contains no CISA KEV entry for CVE-2026-5917; there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time. The NVD record is in Received status (published 2026-08-11, source: VulnCheck), meaning it is awaiting NVD analysis, and it lists no fixed version, patch reference, or vendor remediation guidance. Exploit maturity is NOT_DEFINED. Organizations should track the libgit2 upstream repository and the VulnCheck advisory below for patch availability, and expect the NVD entry to change as analysis completes.
Sources
- NVD, CVE-2026-5917: https://nvd.nist.gov/vuln/detail/CVE-2026-5917
- VulnCheck Advisory; libgit2 shell command injection via SSH libssh2 backend: https://www.vulncheck.com/advisories/libgit2-shell-command-injection-via-ssh-libssh2-backend
- libgit2 upstream repository: https://github.com/libgit2/libgit2