CVE-2026-72538highCWE-88

PrefectHQ Prefect - Argument Injection

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.7%

probabilidade de exploração

0.7%top 50% das CVEs

exploração observada

nãonenhuma fonte reporta

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

PrefectHQ · Prefect

Referências

https://github.com/PrefectHQ/prefect