Medium severity6.5NVD Advisory· Published Aug 13, 2026· Updated Nov 6, 2026
CVE-2026-53788
CVE-2026-53788
Description
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- osv-coords2 versionspkg:rpm/opensuse/rsync&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2016.0
< 3.5.1-1.1+ 1 more
- (no CPE)range: < 3.5.1-1.1
- (no CPE)range: < 3.4.1-160000.6.1
Patches
Vulnerability mechanics
References
3- github.com/RsyncProject/rsync/security/advisories/GHSA-p4c5-8c68-5fjqnvdVendor Advisory
- www.vulncheck.com/advisories/rsync-newline-injection-via-name-converter-uid-gid-mappingnvdThird Party Advisory
- github.com/RsyncProject/rsync/releases/tag/v3.5.0nvdRelease Notes
News mentions
0No linked articles in our index yet.