The vulnerability in libgit2 (CVE-2026-5917) affects versions v0.27.0 through v1.9.0 when built with the libssh2 SSH backend (USE_SSH=libssh2). The gen_proto() function in ssh_libssh2.c constructs a shell command string that includes the repository path without escaping shell metacharacters such as single quotes, semicolons, or pipes. This allows an attacker to inject arbitrary shell commands on the SSH server by providing a malicious repository path, typically via a crafted submodule URL in a .gitmodules file. When a recursive clone processes this submodule, the injected commands execute under the victim's SSH user account. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Successful exploitation enables remote attackers to execute arbitrary commands on the SSH server with the privileges of the victim's SSH user account. This can lead to full compromise of the server, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend for operations involving untrusted repository paths or submodules. Consider disabling recursive cloning of submodules or sanitizing repository paths to prevent injection of shell metacharacters.