High severity · published Aug 13, 2026
CVE-2026-53790
rsync < 3.5.0 Command Injection via Multiple Code Paths
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
rsync · RsyncProject
through 3.4.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53790
github.com
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
github.com
https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq
www.vulncheck.com
https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths
More from rsync
9.1
CVE-2026-53791
rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
8.2
CVE-2026-70456
rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
8.2
CVE-2026-70457
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
8.2
CVE-2026-70458
rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
8.2
CVE-2026-70461
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry