CVE-2026-85756

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85756
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-85756.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-85756
Aliases
Published
2026-09-16T16:31:24Z
Modified
2026-09-18T03:33:31Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
SSH.NET: ScpClient allows server-side RCE via default SCP path handling
Details

SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters not neutralized by the active IRemotePathTransformation can execute commands as the authenticated SSH user. Exploitation requires a shell-based server and a path crafted for that shell's parsing rules; non-shell servers and paths fully neutralized by the selected transformation are not affected. RemotePathTransformation.ShellQuote is available for POSIX shells, while SftpClient avoids a remote shell entirely. This issue is fixed in version 2026.0.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85756.json"
}
References

Affected packages

Git / github.com/sshnet/ssh.net

Affected ranges

Type
GIT
Repo
https://github.com/sshnet/ssh.net
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c66b9f8fb06c12e71761e58a577b1e796026310f
Fixed
7b2fd3dbf2c86a80a7b06cea020aa5f821c9902e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2016.*
2016.1.0
2023.*
2023.0.0
2023.0.1
2024.*
2024.0.0
2024.1.0
2024.2.0
2025.*
2025.0.0
2025.1.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-85756.json"