SSH.NET is a .NET library for SSH operations. In versions before 2026.0.0, the ScpClient component inserts user-supplied remote paths directly into shell commands executed on the server. The default path transformation (RemotePathTransformation.DoubleQuote) does not safely quote all shell metacharacters, leading to improper neutralization of special elements (CWE-78). An attacker controlling the remote path can craft input that executes arbitrary commands with the privileges of the authenticated SSH user, but only if the server uses a shell-based command interpreter and the path is not fully neutralized by the transformation. The issue does not affect non-shell servers or when using RemotePathTransformation.ShellQuote for POSIX shells or SftpClient which avoids shell usage. The vulnerability is resolved in SSH.NET version 2026.0.0.

Successful exploitation allows an attacker who can supply a crafted remote path to execute arbitrary OS commands on the server with the privileges of the authenticated SSH user. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The attack requires a shell-based server and a vulnerable path transformation setting.

Upgrade to SSH.NET version 2026.0.0 or later, where this vulnerability is fixed. Alternatively, use RemotePathTransformation.ShellQuote for POSIX shells or use SftpClient which does not invoke a remote shell. Avoid using RemotePathTransformation.DoubleQuote on shell-based servers with untrusted path input. Patch status is confirmed fixed in version 2026.0.0.