CVE-2026-59846

LowCVSS 3.9/10Last modified Sep 1, 2026

Description

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-78CWE-77

Affected software

VendorProductVersions
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Hardened Images—

References

Timeline

Published
Jul 21, 2026
Last modified
Sep 1, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-598477.5A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity proteCVE-2026-598485.3A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely,CVE-2026-598497.5A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitCVE-2026-59857.3A security flaw has been discovered in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the fileCVE-2026-598507.5A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associaCVE-2026-598518.8A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated KerbeCVE-2026-598536.5SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search crCVE-2026-598544.9SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts attacker-supplied absoCVE-2026-598558.6SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanCVE-2026-598567.8Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interCVE-2026-598575.5Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translateCVE-2026-598587.8Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpola