Live › vulnerability › CVE-2026-5366
Prefect's GitRepository storage class passes the commit_sha and directories parameters to git without validation or a `--` separator, so user-supplied values can inject git flags such as `--upload-pack`. An attacker who can create deployments can run arbitrary commands on worker machines.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Teams running Prefect 3.1.11 through 3.6.24 that use GitRepository storage for deployments, where commit_sha or directories can be set by users who create deployments. The risk is highest in multi-tenant shared work pools, where one tenant's deployment can run commands on workers used by others. Deployments that do not take these parameters from untrusted users are less exposed, but the sources do not say how far that limits the risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| prefect | pypi | >= 3.1.11, < 3.6.25 | 3.6.25 |
pip show prefect or prefect version.GitRepository storage with commit_sha or set from user input.directoriesprefect to 3.6.25 or later (affected range 3.1.11 through 3.6.24).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Prefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
This page as .md · .json · in your agent: get_signal("CVE-2026-5366")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.