CVE-2026-5917 is a high severity command injection in libgit2 when built with the libssh2 SSH backend. A crafted submodule URL in .gitmodules can make the remote server's shell run injected commands during a recursive clone. Fixed in libgit2 1.8.7 and 1.9.7.
What's affected
- Product: libgit2, only when built with the libssh2 backend (
USE_SSH=libssh2). - Affected: versions before 1.8.7, and 1.9.0 before 1.9.7.
- Fixed: 1.8.7 and 1.9.7.
- Also check anything that bundles libgit2: language bindings and tools built on it can carry their own copy.
How to check if you're exposed
Find the libgit2 your software uses and how it was built.
pkg-config --modversion libgit2
ldd $(which your-tool) | grep libgit2
Then check the SSH backend. In the build configuration look for USE_SSH=libssh2. Builds that use another SSH backend or none are not covered by this advisory. For language bindings such as those for Python, Ruby, Node or Rust, look at whether the package ships a bundled libgit2 and at which version, because upgrading the system library will not change a bundled copy.
What to do now
- Upgrade libgit2 to 1.8.7 or 1.9.7, or to a bundling package version that contains one of them.
- Rebuild or update every binding or tool that statically bundles libgit2.
- Until then, do not recursively clone repositories you do not trust over SSH with affected builds.
- Review .gitmodules in untrusted repositories before cloning with submodules.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-78 (OS Command Injection). The function gen_proto() in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping, then hands it to libssh2_channel_exec(). Quote marks, semicolons or pipes in the path are then read by the remote shell.
The twist is the route. A malicious .gitmodules file can carry the crafted submodule URL, so the trigger is a recursive clone by the victim. The injected commands run on the SSH server, under the SSH user account the victim connects as. The record scores it 8.8 (High). The VulnCheck advisory lists CVSS 8.6 (High) using the newer CVSS 4.0 vector, so the two numbers differ. The record does not mark it as exploited in the wild.
Try it yourself
This demo shows how a fix that already exists is surfaced for an affected dependency, which is the situation here: upgrade to a patched libgit2.
Click through it at your own pace, or open it full screen.
Quick check
Which libgit2 builds are affected?
Those built with the libssh2 SSH backend, on versions before 1.8.7 and on 1.9.0 before 1.9.7.
Sources
Last reviewed: 18 October 2026.
