#command-injection

CVE-2026-5917: OS Command Injection in libgit2’s SSH Backend

libgit2’s libssh2 backend quotes the repository path but escapes nothing. One quote in the path can run commands on an SSH server that gives a shell.