Skip to content

GHSA-5hcf-7xxm-rmqq on CTRL-OS 26.05

Aliases: GHSA-5hcf-7xxm-rmqq, CVE-2026-53790

Packages: rsync

Status: Plausible

Advisory Information

Four injection sinks: (a) the RSYNC_CONNECT_PROG %H host substitution was placed into a shell command unquoted; (b) daemon exec hooks (pre-/post-xfer, early exec) expanded %RSYNC_*% values into a shell unquoted; (c) rsync-ssl expanded an untrusted SSL hostspec into the openssl/stunnel command line and stunnel config with no character policy; (d) the remote-shell argument quoting omitted newline/CR, so a newline in a remote path could split off a second command.

Fix: shell-quote the %H substitution; shell-escape hook expansions (without leaking the escaping into ordinary string parameters); validate rsync-ssl hostnames before invoking any helper; add newline/CR to the remote-shell quoting set.

Tests: connect-prog-host-quoting, daemon-exec-rsync-env-shell-escape, rsync-ssl-hostname-validation, remote-shell-newline-escaping.

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”