diff --git a/Cargo.lock b/Cargo.lock
index 8071a59930..91bb3e47d3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -479,7 +479,7 @@ checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
 
 [[package]]
 name = "libgit2-sys"
-version = "0.18.7+1.9.6"
+version = "0.18.8+1.9.7"
 dependencies = [
  "cc",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index b7b0d069c9..ea3a69b470 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -20,7 +20,7 @@ url = { version = "2.5.4", optional = true }
 bitflags = "2.1.0"
 libc = "0.2"
 log = "0.4.8"
-libgit2-sys = { path = "libgit2-sys", version = "0.18.7" }
+libgit2-sys = { path = "libgit2-sys", version = "0.18.8" }
 
 [target."cfg(all(unix, not(target_os = \"macos\")))".dependencies]
 openssl-sys = { version = "0.9.45", optional = true }
diff --git a/README.md b/README.md
index d25e9dbb2d..78b2060f20 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ stable release as well.
 
 ## Version of libgit2
 
-Currently this library requires libgit2 1.9.6 (or newer patch versions). The
+Currently this library requires libgit2 1.9.7 (or newer patch versions). The
 source for libgit2 is included in the libgit2-sys crate so there's no need to
 pre-install the libgit2 library, the libgit2-sys crate will figure that and/or
 build that for you. On the other hand, if an appropriate version of `libgit2`
diff --git a/libgit2-sys/CHANGELOG.md b/libgit2-sys/CHANGELOG.md
index 0841cc61ec..f0532e879f 100644
--- a/libgit2-sys/CHANGELOG.md
+++ b/libgit2-sys/CHANGELOG.md
@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.18.8+1.9.7 - 2026-08-21
+[0.18.7...0.18.8](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.7+1.9.6...libgit2-sys-0.18.8+1.9.7)
+
+### Changed
+
+- Updated to libgit2 [1.9.7](https://github.com/libgit2/libgit2/releases/tag/v1.9.7).
+  This fixes
+  [CVE-2026-5917](https://github.com/libgit2/libgit2/security/advisories/GHSA-xqj4-2j5v-rr75),
+  a potential command injection on the remote host
+  via unescaped repository paths in the libssh2 SSH transport.
+
 ## 0.18.7+1.9.6 - 2026-07-22
 [0.18.6...0.18.7](https://github.com/rust-lang/git2-rs/compare/libgit2-sys-0.18.6+1.9.5...libgit2-sys-0.18.7+1.9.6)
 
diff --git a/libgit2-sys/Cargo.toml b/libgit2-sys/Cargo.toml
index 67b8b49c81..8db52d62b4 100644
--- a/libgit2-sys/Cargo.toml
+++ b/libgit2-sys/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "libgit2-sys"
-version = "0.18.7+1.9.6"
+version = "0.18.8+1.9.7"
 authors = ["Josh Triplett <josh@joshtriplett.org>", "Alex Crichton <alex@alexcrichton.com>"]
 links = "git2"
 build = "build.rs"
diff --git a/libgit2-sys/build.rs b/libgit2-sys/build.rs
index 6ecd018233..fd4bf6516e 100644
--- a/libgit2-sys/build.rs
+++ b/libgit2-sys/build.rs
@@ -9,7 +9,7 @@ fn try_system_libgit2(
     experimental_sha256: bool,
 ) -> Result<pkg_config::Library, Box<dyn std::error::Error>> {
     let mut cfg = pkg_config::Config::new();
-    let range_version = "1.9.6".."1.10.0";
+    let range_version = "1.9.7".."1.10.0";
 
     let lib = if experimental_sha256 {
         // Determine whether experimental SHA256 object support is enabled.
diff --git a/libgit2-sys/libgit2 b/libgit2-sys/libgit2
index 26055f5af7..49e408b320 160000
--- a/libgit2-sys/libgit2
+++ b/libgit2-sys/libgit2
@@ -1 +1 @@
-Subproject commit 26055f5af74ab1cf636d272e8a34315496d3f06f
+Subproject commit 49e408b3208bc3093757a1c2db938d3590f3f412