Skip to content

[GHSA-7pm4-56h2-5rxr] Prefect version 3.6.23 is vulnerable to remote code... #8708

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bdalpe wants to merge 1 commit into
base: bdalpe/advisory-improvement-8708
Choose a base branch
from
+31 −3
Open

[GHSA-7pm4-56h2-5rxr] Prefect version 3.6.23 is vulnerable to remote code... #8708

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 31 additions & 3 deletions advisories/unreviewed/2026/06/GHSA-7pm4-56h2-5rxr/GHSA-7pm4-56h2-5rxr.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7pm4-56h2-5rxr",
"modified": "2026-06-20T18:31:29Z",
"modified": "2026-06-20T18:31:35Z",
"published": "2026-06-20T18:31:29Z",
"aliases": [
"CVE-2026-5366"
],
"details": "Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.",
"summary": "Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)",
"details": "Prefect version <=3.6.24 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "prefect"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.25"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 3.6.24"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5366"
},
{
"type": "PACKAGE",
"url": "https://github.com/prefecthq/prefect"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a"
Expand Down