---
id: CVE-2026-5366
aliases:
  - GHSA-7pm4-56h2-5rxr
title: >-
  Prefect has Git Flag Injection via commit_sha and directories Parameters
  Leading to Remote Code Execution (RCE)
summary: >-
  Prefect has Git Flag Injection via commit_sha and directories Parameters
  Leading to Remote Code Execution (RCE)
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: prefect
product: prefect
ecosystem: pip
affected:
  - 'prefect >= 3.1.11, < 3.6.25'
patched:
  - prefect 3.6.25
published: '2026-06-20'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T21:31:24.709256709Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7pm4-56h2-5rxr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5366'
  - url: 'https://github.com/PrefectHQ/prefect/pull/21384'
  - url: >-
      https://github.com/PrefectHQ/prefect/commit/6a9d9918716ce4ee0297b69f3046f7067ef1faae
  - url: 'https://github.com/PrefectHQ/prefect'
  - url: 'https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a'
  - url: 'https://github.com/advisories/GHSA-7pm4-56h2-5rxr'
tags:
  - osv
  - pip
  - exploit-available
  - ghsa
epss: 0.01034
epssPercentile: 0.64061
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/renat0z3r0/prefect-cve-2026-5366'
  checkedAt: '2026-11-07T18:18:49.299Z'
exploitAvailable: true
cwe:
  - CWE-94
ingestedAt: '2026-11-03T21:55:50.537Z'
---

## Overview

Prefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.

## Affected packages

- `prefect >= 3.1.11, < 3.6.25`

## Remediation

Upgrade to a patched release:

- `prefect 3.6.25`