CVE-2026-5917 affects libgit2 versions prior to 1.8.7 and 1.9.0 prior to 1.9.7 when built with the libssh2 SSH backend (USE_SSH=libssh2). The vulnerability is a shell command injection in the gen_proto() function within ssh_libssh2.c, where the repository path is embedded directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(). An attacker can craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote SSH server's shell to execute arbitrary commands under the victim's SSH user account.

Successful exploitation allows remote attackers to execute arbitrary shell commands on the SSH server under the victim's SSH user account. This can lead to full compromise of the server's privileges accessible to that user, including data theft, system manipulation, or further lateral movement. The CVSS 3.1 score is 8.8, indicating a high severity impact with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality, integrity, and availability impacts.

A fix is available in libgit2 versions 1.8.7 and 1.9.7 and later. Users should upgrade to these or newer versions to remediate this vulnerability. Until patched, avoid using vulnerable versions built with the libssh2 SSH backend or do not process untrusted repository paths containing shell metacharacters. No vendor advisory content was provided to indicate alternative mitigations or that the issue is already mitigated.