A shell command injection vulnerability exists in libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 when built with the libssh2 SSH backend. The vulnerability allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters. This occurs due to improper escaping in the gen_proto() function in ssh_libssh2.c, which inserts the repository path directly into a shell command string. An attacker can exploit this by crafting a malicious submodule URL in a .gitmodules file that triggers command execution during a recursive clone.