CVE-2026-85756

SSH.NET, a widely used Secure Shell library for .NET, is vulnerable to command injection (CWE-78) in its ScpClient, which places caller-supplied remote paths directly into the scp command executed on the server. When an application passes an attacker-controlled remote path to a shell-based SSH server, shell metacharacters not neutralized by the active IRemotePathTransformation (including the default DoubleQuote transformation) are interpreted by the remote shell, allowing an authenticated attacker to execute arbitrary commands with the privileges of the SSH user. Exploitation requires valid low-privilege SSH credentials, a shell-based server, and a path crafted for that shell's parsing rules, so attack complexity is high; non-shell servers and applications using SftpClient (which avoids the remote shell entirely) are not affected. Any application built on SSH.NET prior to 2026.0.0 that uses ScpClient with attacker-influenced remote paths is affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not on CISA's KEV list.

What to do: Upgrade to SSH.NET 2026.0.0. Where an immediate upgrade is not possible, switch from ScpClient to SftpClient (which avoids the remote shell entirely) or use RemotePathTransformation.ShellQuote for POSIX shell servers, and audit code for attacker-controlled remote paths passed to ScpClient.