Threats affecting pkg:github/libgit2/libgit2

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend contain a shell command injection vulnerability. This flaw allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path with unescaped shell metacharacters. The vulnerability arises because the repository path is inserted directly into a shell command without proper escaping, enabling command injection during recursive clone operations involving malicious submodule URLs.