CVE-2026-5366
Git Argument Injection in prefecthq/prefect
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Git Argument Injection in prefecthq/prefect
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
- Record
CVE-2026-5366- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2026-38128
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
- Record
EUVD-2026-38128- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7pm4-56h2-5rxr
Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
Prefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
- Record
GHSA-7pm4-56h2-5rxr- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-03
NVD
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
- Record
CVE-2026-5366- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Git Argument Injection in prefecthq/prefect
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
- Record
CVE-2026-5366- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-7pm4-56h2-5rxr
Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
Prefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
- Record
GHSA-7pm4-56h2-5rxr- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prefectPyPI |
3.1.11 up to 3.6.25 | 3.6.25 |
prefectPyPI |
3.1.11 up to 3.6.25, plus listed versions 3.1.123.1.12.dev13.1.12.dev23.1.12.dev33.1.12.dev4 Show 45 moreShow less3.1.12.dev53.1.133.1.13.dev13.1.13.dev23.1.13.dev33.1.13.dev43.1.13.dev53.1.13.dev63.1.143.1.14.dev13.1.14.dev23.1.14.dev33.1.14.dev43.1.153.1.15.dev13.1.15.dev23.1.15.dev33.1.15.dev43.1.15.dev53.1.15.dev63.1.16.dev13.1.16.dev23.1.16.dev33.1.16.dev43.1.16.dev53.1.16.dev63.1.16.dev73.2.03.2.13.2.103.2.10.dev13.2.10.dev23.2.10.dev33.2.10.dev43.2.113.2.123.2.12.dev13.2.12.dev23.2.12.dev33.2.12.dev43.2.133.2.13.dev23.2.13.dev33.2.13.dev43.2.14 |
3.6.25 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | renat0z3r0/prefect-cve-2026-5366 | 2026-06-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, references | OSV | |
| affected, facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-5366 is a critical vulnerability (CVSS 9.9) in Prefect, published June 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 64th percentile. Fixed in prefect 3.6.25.
References
huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a
nvd.nist.gov/vuln/detail/CVE-2026-5366
github.com/PrefectHQ/prefect/pull/21384
Left out here: 291 versions. The JSON record has them.