A shell command injection vulnerability exists in libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 when built with the libssh2 SSH backend. The vulnerability allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path with unescaped shell metacharacters. This occurs due to improper escaping in the gen_proto() function, which inserts the repository path directly into a shell command string. The issue can be triggered by crafting a malicious submodule URL in a .gitmodules file during a recursive clone operation.