{"id":"CVE-2026-5366","kind":"vulnerability","aliases":["CVE-2026-5366","GHSA-7pm4-56h2-5rxr"],"related":[],"title":"Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)","description":"Prefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.","summary":"Prefect's GitRepository storage class passes the commit_sha and directories parameters to git without validation or a `--` separator, so user-supplied values can inject git flags such as `--upload-pack`. An attacker who can create deployments can run arbitrary commands on worker machines.","severity":"critical","cvss":9.9,"epss":0.01034,"exploited":false,"exploited_at":null,"products":[{"name":"prefect","fixed":["3.6.25"],"affected":">= 3.1.11, < 3.6.25","ecosystem":"pypi"},{"name":"prefect","fixed":[],"affected":"= 3.6.23","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-94","multi-tenant","package","prefect","python","self-hosted"],"not_affected_if":["no-git-storage","single-tenant","version-outside-range"],"how_to_check":"- Check the installed Prefect version with `pip show prefect` or `prefect version`.\n- Look for deployments that use `GitRepository` storage with `commit_sha` or `directories` set from user input.\n- Check whether shared work pools run workers for multiple tenants.","fix":"- Upgrade `prefect` to `3.6.25` or later (affected range 3.1.11 through 3.6.24).","status":"open","published_at":"2026-06-20T17:16:26+00:00","first_seen_at":"2026-11-03T21:19:44+00:00","triaged_at":"2026-11-03T21:28:52+00:00","updated_at":"2026-11-03T22:07:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T21:28:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `prefect` to `3.6.25` or later (affected range 3.1.11 through 3.6.24).","reach":"network","title":"Prefect: git flag injection in storage parameters enables remote code execution","impact":"high","summary":"Prefect's GitRepository storage class passes the commit_sha and directories parameters to git without validation or a `--` separator, so user-supplied values can inject git flags such as `--upload-pack`. An attacker who can create deployments can run arbitrary commands on worker machines.","audience":"developers","category":"package","nicknames":[],"who_cares":["prefect","python","self-hosted","multi-tenant"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Arbitrary commands run on worker machines via deployment parameters.","analyst_note":"","how_to_check":"- Check the installed Prefect version with `pip show prefect` or `prefect version`.\n- Look for deployments that use `GitRepository` storage with `commit_sha` or `directories` set from user input.\n- Check whether shared work pools run workers for multiple tenants.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-range","no-git-storage","single-tenant"],"who_is_affected":"Teams running Prefect 3.1.11 through 3.6.24 that use GitRepository storage for deployments, where commit_sha or directories can be set by users who create deployments. The risk is highest in multi-tenant shared work pools, where one tenant's deployment can run commands on workers used by others. Deployments that do not take these parameters from untrusted users are less exposed, but the sources do not say how far that limits the risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":4356,"output_tokens":616,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A '-5366':20A,28A '-94':32B '3.1.11':90C '3.6.24':92C '56h2':24A '5rxr':25A '7pm4':23A 'addit':156C 'allow':139C,174C 'arbitrari':83B,143C,183C 'attack':76B,140C 'checkout':170C 'class':46B,112C 'code':15A,97C 'command':84B,122C,184C 'commit':7A,49B,114C 'compromis':188C 'control':106C 'creat':79B 'creation':179C 'cve':18A,26A 'cwe':31B 'deploy':80B,178C 'directori':10A,52B,158C 'distinguish':132C 'due':99C 'enabl':151C 'environ':196C 'execut':16A,98C,152C,182C 'exploit':162C 'extern':154C 'flag':4A,69B,137C,145C,166C 'ghsa':22A 'ghsa-7pm4-56h2-5rxr':21A 'git':3A,55B,68B,121C,136C,144C,165C 'gitrepositori':44B,110C 'handl':102C 'host':41B 'improp':101C 'includ':128C 'inject':5A,67B,142C,164C 'input':107C,134C 'lack':123C 'lead':12A 'machin':87B,187C 'multi':34B,194C 'multi-ten':33B,193C 'oper':171C 'pack':74B,150C 'packag':36B 'paramet':11A,53B,116C,159C 'pass':47B,119C 'permiss':180C 'pool':191C 'prefect':1A,29A,30A,37B,42B,88C 'program':155C 'python':38B 'rce':17A 'remot':14A,96C 'run':82B 'self':40B 'self-host':39B 'separ':60B,130C 'sha':8A,50B,115C 'share':189C 'spars':169C 'sparse-checkout':168C 'storag':45B,111C 'suppli':64B 'tenant':35B,195C 'upload':73B,149C 'upload-pack':72B,148C 'user':63B,105C,133C,176C 'user-control':104C 'user-suppli':62B 'valid':57B,124C 'valu':65B 'version':89C 'via':6A 'vulner':94C,173C 'without':56B 'work':190C 'worker':86B,186C","nicknames":[],"mitigations":[],"who_affected":"Teams running Prefect 3.1.11 through 3.6.24 that use GitRepository storage for deployments, where commit_sha or directories can be set by users who create deployments. The risk is highest in multi-tenant shared work pools, where one tenant's deployment can run commands on workers used by others. Deployments that do not take these parameters from untrusted users are less exposed, but the sources do not say how far that limits the risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["prefect"],"ptokens":["prefect"],"labels":["critical","cwe94","multitenant","package","prefect","pypi","python","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2026-06-20T17:16:26+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":1,"sources":[{"source":"ghsa","external_id":"GHSA-7pm4-56h2-5rxr","url":"https://github.com/advisories/GHSA-7pm4-56h2-5rxr","severity":"critical","published_at":"2026-06-20T18:31:29+00:00","modified_at":"2026-11-03T21:18:14+00:00","first_seen_at":"2026-11-03T21:19:44+00:00","fetched_at":"2026-11-03T21:24:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-5366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5366","severity":null,"published_at":"2026-06-20T17:16:26+00:00","modified_at":"2026-10-25T23:10:00+00:00","first_seen_at":"2026-11-03T22:07:19+00:00","fetched_at":"2026-11-03T22:07:19+00:00","note":null}],"documents":[{"id":60942,"url":"https://github.com/PrefectHQ/prefect/pull/21384","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60943,"url":"https://github.com/PrefectHQ/prefect/commit/6a9d9918716ce4ee0297b69f3046f7067ef1faae","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61064,"url":"https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a","title":"Exploit: huntr.com","kind":"poc","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"poc","confidence":null,"note":"Exploit: huntr.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}