Skip to content
OpenAdvisories
High USN-8809-1 1 CVE

libgit2 vulnerability

Published Sep 23, 2026 · Updated Sep 24, 2026

Ecosystem: Ubuntu

Summary

Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly
handled certain repository URLs when using the SSH transport. A remote
attacker could possibly use this issue to execute arbitrary commands.

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS libgit2 1.7.2+ds-1ubuntu3.2
Ubuntu · 26.04 LTS 26.04:LTS libgit2 1.9.1+ds-1ubuntu1.2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libgit2 0.24.1-2ubuntu0.2+esm4
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libgit2 0.26.0+dfsg.1-1.1ubuntu0.2+esm3
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS libgit2 0.28.4+dfsg.1-2ubuntu0.1+esm2
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS libgit2 1.1.0+dfsg.1-4.1ubuntu0.1+esm2

Vulnerabilities 1

  • High 8.8
    CVE-2026-5917

    libgit2 Shell Command Injection via ssh_libssh2 Backend

    libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository pat…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-5917