CVE-2026-5366

Katalog CVE

CVSS 9.9 · Critical EPSS 1,0%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada prefect. Skor CVSS 3.0 9.9 (Critical) menurut huntr.dev.

Deskripsi (NVD)

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.

Rincian

Terbit di NVD

20 Juni 2026

Terakhir diubah

1 Juli 2026

Status NVD

Analyzed

CVSS 3.0

9.9 (Critical), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a exploit · advisory pihak ketiga