{"id":"CVE-2026-5366","aliases":["GHSA-7pm4-56h2-5rxr"],"title":"Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)","summary":"Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendor":"prefect","product":"prefect","ecosystem":"pip","affected":["prefect >= 3.1.11, < 3.6.25"],"patched":["prefect 3.6.25"],"published":"2026-06-20","updated":"2026-11-03","sourceUpdated":"2026-11-03T21:31:24.709256709Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7pm4-56h2-5rxr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5366"},{"url":"https://github.com/PrefectHQ/prefect/pull/21384"},{"url":"https://github.com/PrefectHQ/prefect/commit/6a9d9918716ce4ee0297b69f3046f7067ef1faae"},{"url":"https://github.com/PrefectHQ/prefect"},{"url":"https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a"},{"url":"https://github.com/advisories/GHSA-7pm4-56h2-5rxr"}],"tags":["osv","pip","exploit-available","ghsa"],"epss":0.01034,"epssPercentile":0.64061,"exploits":{"github":1,"githubRepos":["https://github.com/renat0z3r0/prefect-cve-2026-5366"],"checkedAt":"2026-11-07T18:18:49.299Z"},"exploitAvailable":true,"cwe":["CWE-94"],"ingestedAt":"2026-11-03T21:55:50.537Z","slug":"CVE-2026-5366","body":"## Overview\n\nPrefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.\n\n## Affected packages\n\n- `prefect >= 3.1.11, < 3.6.25`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `prefect 3.6.25`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":54.5,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}