Description

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T15:19:42.870Z",
  "pubdate": "2026-08-13T15:19:42.870Z",
  "executiveSummary": "A newline injection vulnerability exists within the name-converter uid/gid mapping interface of rsync before version 3.5.0. This flaw permits local attackers to forge arbitrary protocol messages by crafting user or group names that incorporate newline characters. The primary business and technical impact includes the corruption of user ID and group ID mapping logic, allowing malicious actors to manipulate data exchanges over internal pipe-based mechanisms. Affected systems comprise all rsync deployments utilizing vulnerable versions prior to 3.5.0. The associated risk implication involves the potential circumvention of intended access controls and privilege boundaries through logic corruption. Attacker capabilities are constrained to local execution environments where they possess the ability to create user or group names containing newline characters. Successful exploitation requires the targeted system to process attacker-influenced data via the line-oriented protocol interface, subsequently forcing the rsync daemon to interpret malicious inputs as legitimate protocol commands.",
  "technicalDetails": "The vulnerability stems from improper input sanitization within the name-converter uid/gid mapping interface of the rsync utility. The vulnerable component is the line-oriented protocol parser responsible for handling user and group name conversions transmitted over internal pipe-based mechanisms. Affected software versions include all rsync releases prior to 3.5.0. Exploitation requires local access, where an attacker has the capability to define or influence user or group names within the system context. The vulnerability does not mandate network exposure for initial exploitation, relying instead on local administrative or operational interfaces where user and group mappings are processed.\nThe root cause of the issue is the failure of the rsync daemon to adequately validate or strip newline characters (such as LF or CR) from string inputs representing user and group names before passing them into the line-oriented protocol stream. Because the protocol relies on newline delimiters to separate individual command and data frames, the insertion of raw newline characters inside a user or group name allows the injected text to break out of its intended parameter field and span across multiple protocol lines.\nThe step-by-step attack flow proceeds as follows: First, the local attacker crafts a malicious user or group name containing embedded newline characters combined with valid rsync protocol syntax. Second, the attacker introduces this crafted name into the system environment where rsync will interact with it during uid/gid mapping operations. Third, when the rsync daemon queries or processes the name-converter uid/gid mapping interface, it reads the unvalidated string and transmits it over the pipe-based line-oriented protocol. Fourth, due to the lack of sanitization, the embedded newline characters cause the protocol parser to prematurely terminate the expected data field and interpret the subsequent portion of the attacker's string as a new, distinct protocol command or message. Fifth, the rsync daemon processes this forged input as legitimate protocol input, resulting in the corruption of the internal uid/gid mapping logic and potentially altering security-relevant execution states."
}