CVE-2026-53790

A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNC_CONNECT_PROG variable, daemon hooks, rsync-ssl, and remote-shell parsing—executing commands with the privileges of the running process or user.

This Important vulnerability in rsync allows for remote command injection due to insufficient sanitization of user-supplied input across multiple code paths. While the attack complexity is high, successful exploitation could lead to arbitrary command execution under the privileges of the rsync process or the invoking user, impacting confidentiality, integrity, and availability. This risk is particularly relevant in environments where rsync is used for remote synchronization with untrusted sources or destinations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not set RSYNC_CONNECT_PROG or pass untrusted hostnames/paths into rsync / rsync-ssl. If rsyncd is required, omit pre-xfer/post-xfer/early exec unless the command ignores client-controlled RSYNC_* values, and restrict TCP/873 to trusted clients