Source: libgit2 Version: 1.9.6+ds-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for libgit2. CVE-2026-5917[0]: | libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH | backend (USE_SSH=libssh2) contain a shell command injection | vulnerability that allows remote attackers to execute arbitrary | commands on an SSH server by supplying a repository path containing | unescaped shell metacharacters such as single quotes, semicolons, or | pipes. The gen_proto() function in ssh_libssh2.c inserts the | repository path directly into a shell command string without | escaping special characters before passing it to | libssh2_channel_exec(), enabling an attacker to craft a malicious | submodule URL in a .gitmodules file that, when processed during a | recursive clone, causes the remote server's shell to interpret | injected commands under the victim's SSH user account. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-5917 https://www.cve.org/CVERecord?id=CVE-2026-5917 [1] https://github.com/libgit2/libgit2/commit/b2105b8e60798cb28086d4c648b1cb4854eadccb Please adjust the affected versions in the BTS as needed. Regards, Salvatore
