Description

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T15:19:43.200Z",
  "pubdate": "2026-08-13T15:19:43.200Z",
  "executiveSummary": "Rsync versions prior to 3.5.0 contain multiple critical command and argument injection vulnerabilities. These flaws allow unauthenticated or remote attackers to execute arbitrary commands under the privileges of the rsync process or the invoking user.\nThe vulnerability class involves improper input sanitization across several critical code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection.\nAttackers can leverage these entry points by supplying malicious input containing shell metacharacters or newline characters via unsanitized user-supplied values such as hostnames and hostspecs.\nSuccessful exploitation compromises the confidentiality, integrity, and availability of the affected system, enabling full code execution within the security context of the running rsync process.",
  "technicalDetails": "The root cause of these vulnerabilities stems from insufficient input validation and improper sanitization of user-supplied data before passing it to underlying shell interpreters or command execution routines.\nThe affected components include multiple execution pathways within rsync prior to version 3.5.0, specifically the handling of the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command parsing.\nAttackers exploit these pathways by injecting shell metacharacters or newline characters into unsanitized parameters, predominantly via hostnames and hostspecs provided during connection initialization or configuration parsing.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious input string containing shell injection payloads or embedded newline characters disguised as a valid hostname or hostspec. Second, the client or daemon processes this input without adequate normalization or escaping. Third, the unsanitized value is concatenated or passed directly into an execution context, such as a remote-shell invocation or the RSYNC_CONNECT_PROG environment variable handler. Fourth, the underlying shell interprets the injected metacharacters, breaking out of the intended argument boundary. Finally, arbitrary commands provided by the attacker are executed with the privileges of the rsync process or the invoking user.\nExploitation may occur remotely or locally depending on the specific code path invoked, potentially requiring no prior authentication if exposed via a vulnerable daemon configuration or wrapper script."
}