libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0951 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-5917:
    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a     shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH     server by supplying a repository path containing unescaped shell metacharacters such as single quotes,     semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into     a shell command string without escaping special characters before passing it to libssh2_channel_exec(),     enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during     a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH     user account.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2113 advisory.

    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a     shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH     server by supplying a repository path containing unescaped shell metacharacters such as single quotes,     semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into     a shell command string without escaping special characters before passing it to libssh2_channel_exec(),     enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during     a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH     user account. (CVE-2026-5917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2083 advisory.

    libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend ( vuln_1_1_1 ) (CVE-2026-53583)

    libgit2 Submodule path traversal (CVE-2026-53584)

    Unbounded Memory Allocation via Delta Object Result-Size Header (CVE-2026-53585)

    libgit2's builtin HTTP transport follows offsite redirects for the initial smart HTTP request by default.
    If the redirected server then returns 401 Unauthorized, libgit2 asks the application credential callback     for credentials using the original remote URL, not the redirected URL. The returned credential is then     attached to the next request to the redirected host as an Authorization header. (CVE-2026-53586)

    libgit2 version 1.9.4 and below is vulnerable to a heap out-of-bounds read in set_data() in     src/libgit2/transports/smart_pkt.c.

    The vulnerable code uses a fixed-size strncmp (smart_pkt.c:239) against the unvalidated capability buffer     of a smart-protocol pkt-line. When the bytes following the pkt-line in the contiguous receive buffer     happen to continue with ct-format=, the comparison spuriously matches, advancing format_str past the     pkt-line boundary. The following memchr(format_str, ' ', len - (format_str - line)) (smart_pkt.c:246) then     underflows its size_t size argument to ~SIZE_MAX and walks the heap looking for a space byte. An     unauthenticated remote attacker who controls (or man-in-the-middles) a Git server reached over     HTTP/HTTPS/SSH/git:// can trigger this on the FIRST ref-pkt of the refs advertisement, before any     capability negotiation has taken place. The OOB walk causes a process crash (SIGSEGV) when memchr enters     an unmapped page, and -- on heap layouts where memchr finds a stray space byte before crashing -- can     additionally drive the git_error_set(...'%.*s', format_len, format_str) formatter to copy a large window     of heap memory into the error string. (CVE-2026-53587)

    libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a     shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH     server by supplying a repository path containing unescaped shell metacharacters such as single quotes,     semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into     a shell command string without escaping special characters before passing it to libssh2_channel_exec(),     enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during     a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH     user account. (CVE-2026-5917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6453 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6453-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 20, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libgit2     CVE ID         : CVE-2026-5917 CVE-2026-53583 CVE-2026-53584 CVE-2026-53585                      CVE-2026-53586 CVE-2026-53587     Debian Bug     : 1144465

    Multiple security issues were discovered in libgit2, a low-level Git     library, which could result in the execution of arbitrary commands on a     remote SSH server, disclosure of credentials, denial of service or the     creation of directories outside a repository's working tree.

    For the stable distribution (trixie), these problems have been fixed in     version 1.9.0+ds-2+deb13u1.

    We recommend that you upgrade your libgit2 packages.

    For the detailed security status of libgit2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libgit2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7ebec18d52 advisory.

    Rebuild applications that use libgit2 via the Rust bindings (git2 / libgit2-sys crates) with the latest     version of the libgit2-sys crate.

    This ensures applications now link against the libgit2 library provided by the system, which now includes     fixes for various security issues compared to the statically linked version of libgit2 that was previously     bundled in the libgit2-sys crate (CVE-2026-5917, CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,     CVE-2026-53584, CVE-2026-53583, and others).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-74c4a6f82e advisory.

    Rebuild applications that use libgit2 via the Rust bindings (git2 / libgit2-sys crates) with the latest     version of the libgit2-sys crate.

    This ensures applications now link against the libgit2 library provided by the system, which now includes     fixes for various security issues compared to the statically linked version of libgit2 that was previously     bundled in the libgit2-sys crate (CVE-2026-5917, CVE-2026-53586, CVE-2026-53587, CVE-2026-53585,     CVE-2026-53584, CVE-2026-53583, and others).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2)     contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands     on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single     quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path     directly into a shell command string without escaping special characters before passing it to     libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file     that, when processed during a recursive clone, causes the remote server's shell to interpret injected     commands under the victim's SSH user account. (CVE-2026-5917)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342217	TencentOS Server 4: rust (TSSA-2026:0951)	Nessus	Tencent Local Security Checks	Local	high
342044	Amazon Linux 2023 : cargo-c (ALAS2023-2026-2113)	Nessus	Amazon Linux Local Security Checks	Local	high
341845	Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2026-2083)	Nessus	Amazon Linux Local Security Checks	Local	high
338355	Debian dsa-6453 : libgit2-1.9 - security update	Nessus	Debian Local Security Checks	Local	high
335948	Fedora 43 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-7ebec18d52)	Nessus	Fedora Local Security Checks	Local	high
335900	Fedora 44 : rust-bat / rust-git-delta / rust-git-interactive-rebase-tool / etc (2026-74c4a6f82e)	Nessus	Fedora Local Security Checks	Local	high
334932	Linux Distros Unpatched Vulnerability : CVE-2026-5917	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-5917

high

Tenable Plugins

high

high

high

high

high

high

high