Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-53790rsync < 3.5.0 Command Injection via Multiple Code Paths
High 8.1
In plain English
A high-severity OS command injection in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | rsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-daemon | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync-daemon | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync-daemon | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-rrsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:9 | rsync-rrsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| Alpine:v3.21 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53790 |
| Alpine:v3.22 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53790 |
| Alpine:v3.23 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53790 |
| Alpine:v3.24 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53790 |
| Debian:12 | rsync | no fix listed | DEBIAN-CVE-2026-53790 |
| Debian:13 | rsync | 3.5.0+ds1-0+deb13u1 | DEBIAN-CVE-2026-53790 |
| Debian:14 | rsync | 3.5.0+ds1-1 | DEBIAN-CVE-2026-53790 |
| Rocky Linux:10 | rsync | 0:3.5.0-3.el10_2 | RLSA-2026:67463 |
| Rocky Linux:8 | rsync | 0:3.1.3-28.el8_10 | RLSA-2026:74095 |
| Rocky Linux:9 | rsync | 0:3.2.7-1.el9_8 | RLSA-2026:67462 |
| Ubuntu:22.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53790 |
| Ubuntu:24.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53790 |
| Ubuntu:26.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53790 |
| Ubuntu:26.10 | rsync | no fix listed | UBUNTU-CVE-2026-53790 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RsyncProject | rsync | 0 – through 3.4.4 |
Weakness: CWE-78, CWE-88 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-5hcf-7xxm-rmqq) vendor-advisory
- rsync 3.5.0 Release Notes release-notes
- https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths third-party-advisory