CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-53790?
CVE-2026-53790 is a critical vulnerability in RsyncProject rsync, published on 13 Aug 2026.
Official description
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
Which versions are affected by CVE-2026-53790?
How do I fix CVE-2026-53790?
Upgrade to a fixed version.
Is CVE-2026-53790 being exploited?
There is no known exploitation of CVE-2026-53790 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-53790, AZL-95834, BELL-CVE-2026-53790, DEBIAN-CVE-2026-53790, ECHO-e7cb-4981-6b94, GHSA-5hcf-7xxm-rmqq and 2 more.