AZL-95834
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95834.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-95834
- Upstream
- Published
- 2026-08-13T15:19:43Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-53790 affecting package rsync for versions less than 3.5.0-1
- Details
-
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
- References