CVE-2026-85756: SSH.NET ScpClient remote code execution via unquoted SCP paths

CVE-2026-85756 · Severity: high · CVSS 7.5 · Published 2026-09-16

SSH.NET's ScpClient component constructs shell commands to transfer files over SSH. When an application passes attacker-influenced remote file paths to ScpClient without proper escaping, an attacker can inject shell metacharacters (such as command substitutions) to execute arbitrary commands on the SSH server as the authenticated user. This affects applications that accept user input for remote file paths and pass it directly to ScpClient against shell-based SSH servers.

Technologies: SSH.NET (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2026-85756 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85756 being exploited in the wild.
How severe is CVE-2026-85756?
High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?
SSH.NET (NuGet) < 2026.0.0, ECOSYSTEM:introduced=0,fixed=2026.0.0.
Is there a fix for CVE-2026-85756?
Yes. SSH.NET (NuGet): upgrade to 2026.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85756 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-85756?
Check whether you run SSH.NET (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • SSH.NET (NuGet): upgrade to 2026.0.0 or later
    dotnet add package SSH.NET --version 2026.0.0

Technical details

The vulnerability is a shell command injection in SSH.NET's ScpClient default path handling. The library constructs scp commands by inserting caller-supplied remote paths into shell commands without sufficient escaping—the default RemotePathTransformation.DoubleQuote does not neutralize shell metacharacters like $(...) or backticks on POSIX shells. An authenticated attacker who can influence the remote path parameter can craft a malicious path to break out of the quoting and execute arbitrary shell commands on the server. Exploitation requires the remote server to be shell-based (not all SSH servers are) and the attacker to craft a path that defeats the active quoting transformation. The fix requires callers to explicitly specify a RemotePathTransformation (e.g., ShellQuote for POSIX shells) rather than silently defaulting to an unsafe behavior; SFTP via SftpClient is recommended as a safer alternative that avoids shell interpretation.

Affected products

  • SSH.NET SSH.NET <unknown

Identifiers

  • CVE-2026-85756
  • GHSA-mggc-4xg6-vcxf

Timeline

  • 2026-09-17: disclosed: Advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.