ghsa-7pm4-56h2-5rxr
CVSS 9.9 pysec
Description
Prefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7pm4-56h2-5rxr/GHSA-7pm4-56h2-5rxr.json"
},
"package": {
"ecosystem": "PyPI",
"name": "prefect",
"purl": "pkg:pypi/prefect"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.11"
},
{
"fixed": "3.6.25"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.1.11",
"3.1.12",
"3.1.12.dev1",
"3.1.12.dev2",
"3.1.12.dev3",
"3.1.12.dev4",
"3.1.12.dev5",
"3.1.13",
"3.1.13.dev1",
"3.1.13.dev2",
"3.1.13.dev3",
"3.1.13.dev4",
"3.1.13.dev5",
"3.1.13.dev6",
"3.1.14",
"3.1.14.dev1",
"3.1.14.dev2",
"3.1.14.dev3",
"3.1.14.dev4",
"3.1.15",
"3.1.15.dev1",
"3.1.15.dev2",
"3.1.15.dev3",
"3.1.15.dev4",
"3.1.15.dev5",
"3.1.15.dev6",
"3.1.16.dev1",
"3.1.16.dev2",
"3.1.16.dev3",
"3.1.16.dev4",
"3.1.16.dev5",
"3.1.16.dev6",
"3.1.16.dev7",
"3.2.0",
"3.2.1",
"3.2.10",
"3.2.10.dev1",
"3.2.10.dev2",
"3.2.10.dev3",
"3.2.10.dev4",
"3.2.11",
"3.2.12",
"3.2.12.dev1",
"3.2.12.dev2",
"3.2.12.dev3",
"3.2.12.dev4",
"3.2.13",
"3.2.13.dev2",
"3.2.13.dev3",
"3.2.13.dev4",
"3.2.14",
"3.2.14.dev1",
"3.2.14.dev2",
"3.2.14.dev3",
"3.2.15",
"3.2.15.dev1",
"3.2.15.dev2",
"3.2.15.dev3",
"3.2.15.dev4",
"3.2.15.dev5",
"3.2.15.dev6",
"3.2.15.dev7",
"3.2.15.dev8",
"3.2.15.dev9",
"3.2.16.dev1",
"3.2.2",
"3.2.2.dev1",
"3.2.2.dev2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.2.6",
"3.2.7",
"3.2.7.dev1",
"3.2.8",
"3.2.8.dev1",
"3.2.8.dev2",
"3.2.8.dev3",
"3.2.8.dev4",
"3.2.9",
"3.3.0",
"3.3.1",
"3.3.2",
"3.3.2.dev1",
"3.3.2.dev2",
"3.3.3",
"3.3.3.dev1",
"3.3.4",
"3.3.4.dev1",
"3.3.4.dev2",
"3.3.4.dev3",
"3.3.5",
"3.3.5.dev1",
"3.3.5.dev2",
"3.3.5.dev3",
"3.3.5.dev4",
"3.3.6",
"3.3.6.dev1",
"3.3.6.dev2",
"3.3.6.dev3",
"3.3.6.dev4",
"3.3.7",
"3.3.7.dev1",
"3.3.8.dev1",
"3.3.8.dev2",
"3.3.8.dev3",
"3.3.8.dev4",
"3.4.0",
"3.4.1",
"3.4.1.dev1",
"3.4.1.dev2",
"3.4.1.dev3",
"3.4.1.dev4",
"3.4.1.dev5",
"3.4.10",
"3.4.10.dev1",
"3.4.11",
"3.4.11.dev1",
"3.4.11.dev2",
"3.4.11.dev3",
"3.4.11.dev4",
"3.4.11.dev5",
"3.4.12",
"3.4.12.dev1",
"3.4.12.dev2",
"3.4.12.dev3",
"3.4.12.dev4",
"3.4.13",
"3.4.13.dev1",
"3.4.13.dev2",
"3.4.13.dev3",
"3.4.14",
"3.4.14.dev1",
"3.4.14.dev2",
"3.4.14.dev3",
"3.4.14.dev4",
"3.4.15",
"3.4.15.dev1",
"3.4.15.dev2",
"3.4.15.dev3",
"3.4.15.dev4",
"3.4.16",
"3.4.16.dev1",
"3.4.16.dev2",
"3.4.16.dev3",
"3.4.16.dev4",
"3.4.16.dev5",
"3.4.16.dev6",
"3.4.17",
"3.4.18",
"3.4.18.dev1",
"3.4.18.dev2",
"3.4.18.dev3",
"3.4.18.dev4",
"3.4.18.dev5",
"3.4.19",
"3.4.19.dev1",
"3.4.19.dev2",
"3.4.19.dev3",
"3.4.19.dev4",
"3.4.19.dev5",
"3.4.2",
"3.4.2.dev1",
"3.4.2.dev2",
"3.4.2.dev3",
"3.4.2.dev4",
"3.4.2.dev5",
"3.4.20",
"3.4.20.dev1",
"3.4.20.dev2",
"3.4.21",
"3.4.21.dev1",
"3.4.21.dev2",
"3.4.21.dev3",
"3.4.21.dev4",
"3.4.21.dev5",
"3.4.22",
"3.4.23",
"3.4.23.dev1",
"3.4.23.dev2",
"3.4.23.dev3",
"3.4.24",
"3.4.24.dev1",
"3.4.24.dev2",
"3.4.24.dev3",
"3.4.24.dev4",
"3.4.24.dev5",
"3.4.25",
"3.4.25.dev1",
"3.4.25.dev2",
"3.4.25.dev3",
"3.4.25.dev4",
"3.4.25.dev5",
"3.4.26.dev1",
"3.4.26.dev2",
"3.4.26.dev3",
"3.4.26.dev4",
"3.4.26.dev5",
"3.4.26.dev6",
"3.4.3",
"3.4.3.dev1",
"3.4.3.dev2",
"3.4.4",
"3.4.4.dev1",
"3.4.4.dev2",
"3.4.5",
"3.4.5.dev1",
"3.4.5.dev2",
"3.4.5.dev3",
"3.4.5.dev4",
"3.4.5.dev5",
"3.4.6",
"3.4.6.dev1",
"3.4.6.dev2",
"3.4.7",
"3.4.7.dev1",
"3.4.7.dev2",
"3.4.7.dev3",
"3.4.7.dev4",
"3.4.7.dev5",
"3.4.7.dev6",
"3.4.7.dev7",
"3.4.7.dev8",
"3.4.7.dev9",
"3.4.8",
"3.4.8.dev1",
"3.4.8.dev2",
"3.4.8.dev3",
"3.4.8.dev4",
"3.4.8.dev5",
"3.4.8.dev6",
"3.4.8.dev7",
"3.4.8.dev8",
"3.4.9",
"3.4.9.dev1",
"3.4.9.dev2",
"3.4.9.dev3",
"3.4.9.dev4",
"3.4.9.dev5",
"3.5.0",
"3.5.1.dev1",
"3.5.1.dev2",
"3.5.1.dev3",
"3.5.1.dev4",
"3.6.0",
"3.6.1",
"3.6.1.dev1",
"3.6.10",
"3.6.11",
"3.6.12",
"3.6.13",
"3.6.13.dev2",
"3.6.14",
"3.6.14.dev1",
"3.6.14.dev2",
"3.6.14.dev3",
"3.6.14.dev4",
"3.6.14.dev5",
"3.6.14.dev6",
"3.6.14.dev7",
"3.6.15",
"3.6.16",
"3.6.16.dev2",
"3.6.16.dev3",
"3.6.16.dev4",
"3.6.16.dev5",
"3.6.16.dev6",
"3.6.16.dev7",
"3.6.17",
"3.6.17.dev1",
"3.6.17.dev4",
"3.6.17.dev5",
"3.6.17.dev6",
"3.6.18",
"3.6.18.dev1",
"3.6.18.dev2",
"3.6.18.dev3",
"3.6.18.dev4",
"3.6.18.dev5",
"3.6.18.dev6",
"3.6.19",
"3.6.19.dev1",
"3.6.19.dev2",
"3.6.19.dev3",
"3.6.2",
"3.6.2.dev1",
"3.6.20",
"3.6.20.dev1",
"3.6.20.dev2",
"3.6.20.dev3",
"3.6.20.dev4",
"3.6.20.dev5",
"3.6.21",
"3.6.21.dev1",
"3.6.21.dev2",
"3.6.21.dev3",
"3.6.21.dev4",
"3.6.21.dev5",
"3.6.22",
"3.6.22.dev1",
"3.6.22.dev2",
"3.6.22.dev3",
"3.6.22.dev4",
"3.6.22.dev5",
"3.6.22.dev6",
"3.6.22.dev7",
"3.6.22.dev8",
"3.6.23",
"3.6.23.dev1",
"3.6.23.dev2",
"3.6.23.dev3",
"3.6.23.dev4",
"3.6.24",
"3.6.24.dev1",
"3.6.24.dev2",
"3.6.24.dev3",
"3.6.24.dev4",
"3.6.24.dev5",
"3.6.25.dev1",
"3.6.25.dev2",
"3.6.25.dev3",
"3.6.25.dev4",
"3.6.25.dev5",
"3.6.25.dev6",
"3.6.25.dev7",
"3.6.3",
"3.6.3.dev1",
"3.6.3.dev2",
"3.6.3.dev3",
"3.6.4",
"3.6.4.dev1",
"3.6.5",
"3.6.5.dev1",
"3.6.5.dev2",
"3.6.5.dev3",
"3.6.5.dev4",
"3.6.6",
"3.6.7",
"3.6.7.dev3",
"3.6.8",
"3.6.8.dev3",
"3.6.9"
]
}
],
"aliases": [
"CVE-2026-5366"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-11-03T21:18:13Z",
"nvd_published_at": "2026-06-20T17:16:26Z",
"severity": "CRITICAL"
},
"details": "Prefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.",
"id": "GHSA-7pm4-56h2-5rxr",
"modified": "2026-11-03T21:31:24.709256709Z",
"published": "2026-06-20T18:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5366"
},
{
"type": "WEB",
"url": "https://github.com/PrefectHQ/prefect/pull/21384"
},
{
"type": "WEB",
"url": "https://github.com/PrefectHQ/prefect/commit/6a9d9918716ce4ee0297b69f3046f7067ef1faae"
},
{
"type": "PACKAGE",
"url": "https://github.com/PrefectHQ/prefect"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a"
}
],
"schema_version": "1.9.2",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)"
}