EUVD-2026-53098
GHSA-h9gr-58w4-64cq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects the requirement for a valid CMS account with project configuration rights; AV:N for the web-accessible application; S:U as impact is contained to the server process running HashBrown CMS.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
4DescriptionCVE.org
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(git checkout ${this.branch || 'master'}), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such as ';', '&&', '|', backticks, and '$()' are not filtered. A user able to configure a project's Git deployer settings can set a malicious branch value (e.g. 'master;<command>#') that executes automatically on every subsequent deployer operation (media upload, content save, etc.), since pullRepo() is invoked unconditionally at the start of each such operation. This is related to CVE-2020-6948, which addressed single-quote escaping of the repo, username, and password fields in the same file's git clone invocation; the branch field used in the unquoted git checkout command was not covered by that fix and remains injectable.
AnalysisAI
OS command injection in HashBrown CMS through version 1.4.6 allows any authenticated user with project configuration access to execute arbitrary OS commands on the server by embedding shell metacharacters in the Git deployer's branch field - an attack surface left exposed by the incomplete remediation of CVE-2020-6948, which fixed single-quote injection in git clone fields but not the branch parameter in the git checkout invocation. GitDeployer.validate() blocks only single-quote characters, leaving semicolons, pipes, ampersands, backticks, and command substitution syntax freely injectable; once planted, the malicious branch value fires automatically on every subsequent deployer operation (media upload, content save) without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the attack is mechanistically trivial given the complete absence of metacharacter filtering.
Technical ContextAI
HashBrown CMS is an open-source headless CMS whose Git deployer component synchronizes content to remote repositories. The vulnerability resides in src/Server/Entity/Deployer/GitDeployer.js within the pullRepo() function, which constructs a shell command via JavaScript template literal interpolation: AppService.exec(git checkout ${this.branch || 'master'}). Because this.branch originates from user-controlled project configuration and is embedded without quoting or escaping into a shell invocation, CWE-78 (Improper Neutralization of Special Elements Used in an OS Command) applies directly. The validate() method provides a false sense of security: it blocks the single-quote character in repo, branch, username, and password fields, but this allowlist-by-exclusion approach misses the full shell metacharacter set. This is a lineage vulnerability - CVE-2020-6948 previously addressed single-quote injection in the same file's git clone call for the repo, username, and password fields; the branch field in the git checkout command was architecturally identical but not covered, leaving the injection surface intact. The CPE cpe:2.3:a:hashbrowncms:hashbrown-cms:*:*:*:*:*:*:*:* confirms all hashbrown-cms releases up to and including 1.4.6 are affected.
RemediationAI
No vendor-released patched version has been identified at time of analysis. The TuranSec advisory at https://cve.turansec.uz/advisories/TRN-B571F773 and the upstream repository at https://github.com/HashBrownCMS/hashbrown-cms should be monitored for patch releases. Until a fix is available, the most effective compensating control is to restrict Git deployer configuration access exclusively to fully trusted administrators via role and permission settings, preventing editor-level or untrusted users from modifying the branch field. If the Git deployer feature is not actively required, disabling it entirely eliminates the attack surface with no functional impact for non-Git workflows. For deployments where Git deployment is necessary, a custom server-side allowlist validating the branch field against a strict regex (e.g., permitting only alphanumeric characters, hyphens, forward slashes, and underscores) can be applied as a code-level patch to GitDeployer.validate() - note this may reject legitimate branch names containing dots or other special characters and requires careful testing. Shell-quoting the branch interpolation (wrapping in single quotes and escaping any embedded single quotes) in the AppService.exec call is the correct structural fix, consistent with the approach applied to other fields in CVE-2020-6948.
More in Hashbrown Cms
View allA remote code execution issue was discovered in HashBrown CMS through 1.3.3. Rated critical severity (CVSS 9.8), this vu
A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. Rated high severity
OS command injection in HashBrown CMS through version 1.4.6 enables any authenticated user holding media resource scope
An issue was discovered in HashBrown CMS before 1.3.2. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today