{"id":"CVE-2026-3515","aliases":["GHSA-cw25-2p92-7f75","PYSEC-2026-2957"],"title":"Prefect has an Argument Injection issue","summary":"Prefect has an Argument Injection issue","severity":"high","cvss":8.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","vendor":"prefect","product":"prefect","ecosystem":"pip","affected":["prefect <= 3.6.18"],"published":"2026-05-26","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:05.309354883Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cw25-2p92-7f75","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3515"},{"url":"https://github.com/PrefectHQ/prefect"},{"url":"https://huntr.com/bounties/f3b048b8-7f4e-45ef-a5a7-cb841c39acde"}],"tags":["osv","pip"],"epss":0.00298,"epssPercentile":0.2269,"ingestedAt":"2026-07-13T18:57:56.918Z","slug":"CVE-2026-3515","body":"## Overview\n\nA vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field. The `reference` field is concatenated directly into a `git clone` command string without proper sanitization, and then parsed by `shlex.split()`. This enables injection of options such as `-c`, leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execution (RCE). The vulnerability affects both the `aget_directory()` and `get_directory()` methods in `src/integrations/prefect-github/prefect_github/repository.py`. This issue does not affect the GitLab and BitBucket integrations, which use a safer list-based command construction approach.\n\n## Affected packages\n\n- `prefect <= 3.6.18`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}