CVE-2026-72538 — PrefectHQ Prefect - Argument Injection
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The …
Published: 2026-08-11 · CVSS: 8.8 · CVSS 3.1
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7