EUVD-2026-53098
GHSA-h9gr-58w4-64cq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects the requirement for a valid CMS account with project configuration rights; AV:N for the web-accessible application; S:U as impact is contained to the server process running HashBrown CMS.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
4DescriptionCVE.org
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(git checkout ${this.branch || 'master'}), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such as ';', '&&', '|', backticks, and '$()' are not filtered. A user able to configure a project's Git deployer settings can set a malicious branch value (e.g. 'master;<command>#') that executes automatically on every subsequent deployer operation (media upload, content save, etc.), since pullRepo() is invoked unconditionally at the start of each such operation. This is related to CVE-2020-6948, which addressed single-quote escaping of the repo, username, and password fields in the same file's git clone invocation; the branch field used in the unquoted git checkout command was not covered by that fix and remains injectable.
AnalysisAI
OS command injection in HashBrown CMS through version 1.4.6 allows any authenticated user with project configuration access to execute arbitrary OS commands on the server by embedding shell metacharacters in the Git deployer's branch field - an attack surface left exposed by the incomplete remediation of CVE-2020-6948, which fixed single-quote injection in git clone fields but not the branch parameter in the git checkout invocation. GitDeployer.validate() blocks only single-quote characters, leaving semicolons, pipes, ampersands, backticks, and command substitution syntax freely injectable; once planted, the malicious branch value fires automatically on every subsequent deployer operation (media upload, content save) without further attacker interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid HashBrown CMS user account with sufficient project-level permissions to read and modify a project's Git deployer configuration, specifically the branch field in the deployer settings panel. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately represents the technical severity: the attack is network-reachable, requires no complex conditions, and yields full confidentiality, integrity, and availability impact on the server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all HashBrown CMS instances running version 1.4.6 or earlier and restrict Git deployer configuration access to a minimal set of highly-trusted administrators only; enable comprehensive audit logging for all Git deployment operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hashbrown Cms
View allA remote code execution issue was discovered in HashBrown CMS through 1.3.3. Rated critical severity (CVSS 9.8), this vu
A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. Rated high severity
OS command injection in HashBrown CMS through version 1.4.6 enables any authenticated user holding media resource scope
An issue was discovered in HashBrown CMS before 1.3.2. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today