Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field. The `reference` field is concatenated directly into a `git clone` command string without proper sanitization, and then parsed by `shlex.split()`. This enables injection of options such as `-c`, leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execution (RCE). The vulnerability affects both the `aget_directory()` and `get_directory()` methods in `src/integrations/prefect-github/prefect_github/repository.py`. This issue does not affect the GitLab and BitBucket integrations, which use a safer list-based command construction approach.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-24 | 1 | Disclosure1 |
| 2026-06-07 | 1 | Patch1 |
| 2026-06-08 | 1 | General1 |
| 2026-06-12 | 1 | Patch1 |
CVE-2026-3515 Prefect 3.6.18の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-3515-prefect-3618/ #IT #Security #cybersecurity
Post summary
The post offers a detailed explanation of CVE-2026-3515 affecting Prefect 3.6.18, covering its impact and mitigation steps, but does not provide a PoC, exploit code, or evidence of active exploitation.
CVE-2026-3515 A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line op… https://www.cve.org/CVERecord?id=CVE-2026-3515
Post summary
This post announces CVE-2026-3515, a command‑line injection flaw in Prefect’s prefect‑github integration (version 3.6.18) that allows attackers to execute arbitrary git commands.
CVE-2026-3515 Prefect 3.6.18の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-3515-prefect-3618/ #IT #Security #cybersecurity
Post summary
The linked article explains the CVE‑2026‑3515 defect in Prefect 3.6.18, detailing its impact and providing patch or mitigation guidance.
CVE-2026-3515 Prefect 3.6.18の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-3515-prefect-3618/ #IT #Security #cybersecurity
Post summary
The article explains the CVE‑2026‑3515 vulnerability in Prefect 3.6.18 and summarizes its impact along with recommended countermeasures, likely covering vendor patches.