CVE-2026-5366

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.

• CWE-94

• https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07aExploit, Third Party Advisory
• https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07aExploit, Third Party Advisory

Published

Jun 20, 2026

Last Modified

Jul 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53647FOSSBilling is a free, open-source billing and client manage…6.9
• CVE-2026-53648FOSSBilling is a free, open-source billing and client manage…5.1
• CVE-2026-5365The LatePoint plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2026-53653Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0…8.7
• CVE-2026-53655node-tar is a full-featured Tar for Node.js. Prior to 7.5.16…5.5
• CVE-2026-53657Lima launches Linux virtual machines, typically on macOS, fo…8.2
• CVE-2026-53661Boruta is a standalone authorization server that aims to imp…8.8
• CVE-2026-53662immich is a high performance self-hosted photo and video man…9.6
• CVE-2026-53663React Router is a router for React. From 7.12.0 until 7.15.1…3.1
• CVE-2026-53666React Router is a router for React. In versions 6.4.0 throug…6.1
• CVE-2026-53667React Router is a router for React. In versions 7.11.0 throu…6.1
• CVE-2026-53668React Router is a router for React. In versions 6.30.2 throu…6.9