Vulnerability Description
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq
- https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-p
FAQ
What is CVE-2026-53790?
CVE-2026-53790 is a vulnerability with a CVSS score of 8.1 (HIGH). rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, includin...
How severe is CVE-2026-53790?
CVE-2026-53790 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53790?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.