JFrog CLI EUVD-2026-98979

Exploitation is gated to 'specific configurations' of JFrog CLI (the exact vulnerable setting is not enumerated in the available data and must be confirmed via the JFrog security advisory), combined with CWE-88 argument injection - the attacker must control input that the CLI incorporates into arguments passed to an underlying command. Limiting factors: High attack complexity (AC:H) reflects those non-default configuration preconditions; the flaw affects JFrog CLI specifically, so only environments running that tool (typically developer workstations and CI/CD pipelines interacting with JFrog Artifactory/Platform) are in scope. Although the CVSS vector states PR:N/UI:N (unauthenticated, no interaction), realistic exploitation generally depends on the CLI being driven against attacker-influenced data.

Signals are mixed and point to a conditional, moderate real-world priority rather than an emergency. The CVSS 3.1 base score is 9.0 (Critical), driven by full C/I/A impact, a scope change (S:C), and no authentication or user interaction (PR:N/UI:N). However, the same vector carries High attack complexity (AC:H), and the description explicitly scopes the flaw to 'specific configurations,' which materially tempers the Critical headline. CWE-88 (argument injection) in a command-line tool typically requires attacker-controlled data to flow into CLI argument construction, so the AV:N rating is plausible mainly in automated contexts (e.g., CI/CD runners consuming untrusted repository/package metadata) - this should be verified against the JFrog advisory. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or mass-scanning pressure: exploitation status is 'no public exploit identified at time of analysis.' Net: a high-ceiling vulnerability whose realistic exploitability is gated by non-default configuration and high complexity. CVSS AV:N implies a network vector, but a local developer CLI often implies local/CI-mediated access - verify the exact data-flow path with the vendor before treating this as remotely exploitable at scale.

In a CI/CD pipeline that invokes JFrog CLI under a vulnerable, non-default configuration, an attacker who can influence input the CLI consumes (for example crafted package or repository metadata) injects extra command-line arguments that get passed to an underlying process, achieving arbitrary code execution on the build host. The high attack complexity (AC:H) means specific preconditions and configuration state must be satisfied. No public exploit code is identified at time of analysis.