Jfrog Cli
Monthly
Arbitrary code execution is possible in JFrog CLI when specific, non-default configurations are combined with an argument-injection weakness (CWE-88) that allows attacker-influenced input to be incorporated into arguments passed to an underlying command. The flaw carries a 9.0 base score with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning the vector formally allows unauthenticated, no-interaction network exploitation, but the High attack complexity reflects the configuration preconditions that gate it rather than ease of use. Only environments running JFrog CLI are in scope - typically developer workstations and CI/CD pipelines that interact with JFrog Artifactory/Platform - and no public exploit has been identified at time of analysis.
Arbitrary code execution is possible in JFrog CLI when specific, non-default configurations are combined with an argument-injection weakness (CWE-88) that allows attacker-influenced input to be incorporated into arguments passed to an underlying command. The flaw carries a 9.0 base score with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning the vector formally allows unauthenticated, no-interaction network exploitation, but the High attack complexity reflects the configuration preconditions that gate it rather than ease of use. Only environments running JFrog CLI are in scope - typically developer workstations and CI/CD pipelines that interact with JFrog Artifactory/Platform - and no public exploit has been identified at time of analysis.