rsync versions before 3.5.0 allow attackers to inject arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and a newline injection in the remote‑shell command. This leads to execution of shell metacharacters or newline characters in unsanitized values such as hostnames and hostspecs, elevating the attacker’s privileges to that of the rsync process or the invoking user. The vulnerability is based on uncontrolled command injection and endpoint manipulation, as indicated by CWE‑78 and CWE‑88.

The affected product is rsync from the RsyncProject. All installations of rsync older than version 3.5.0 are vulnerable. The vulnerability is triggered by untrusted input entered by the user or provided via environment variables or remote hooks.

The vulnerability has a CVSS score of 9.2, classifying it as critical. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of exploitation data does not reduce its potential risk. Attackers can exploit the flaw remotely by manipulating environment variables, remote‑shell commands, or hostspecs, so the attack vector is likely network‑based and requires remote access to the rsync daemon or the ability to spawn a command on an initiating machine. The SSL wrapper and daemon hooks provide multiple independent paths, increasing the likelihood that a successful exploitation can be achieved under various deployment scenarios.