High severity8.1NVD Advisory· Published Aug 13, 2026· Updated Sep 8, 2026
CVE-2026-53790
CVE-2026-53790
Description
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- osv-coords4 versionspkg:rpm/almalinux/rsync-daemonpkg:rpm/almalinux/rsyncpkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/rsync-rrsync
< 3.2.7-1.el9_8+ 3 more
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.4.1-160000.6.1
- (no CPE)range: < 3.2.7-1.el9_8
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.