A shell command injection vulnerability exists in libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 when built with the libssh2 SSH backend. The vulnerability allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters. This occurs because the repository path is inserted directly into a shell command string without escaping special characters during recursive clone operations involving submodules.