CVE-2026-5917

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 , when built with the libssh2 SSH backend, contain a shell command injection vulnerability. The gen_proto() function in ssh_libssh2.c inserts a repository path directly into a shell command string without escaping metacharacters (single quotes,...