CVE-2026-53788 — Newline injection in rsync name-converter uid/gid mapping before 3.5.0

Rsync versions before 3.5.0 contain a newline injection vulnerability in the name-converter uid/gid mapping interface. Local attackers can create user or group names containing newline characters and forge messages in the pipe-based line-oriented protocol.