---
id: CVE-2026-3515
aliases:
  - GHSA-cw25-2p92-7f75
  - PYSEC-2026-2957
title: Prefect has an Argument Injection issue
summary: Prefect has an Argument Injection issue
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
vendor: prefect
product: prefect
ecosystem: pip
affected:
  - prefect <= 3.6.18
published: '2026-05-26'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:05.309354883Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cw25-2p92-7f75'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-3515'
  - url: 'https://github.com/PrefectHQ/prefect'
  - url: 'https://huntr.com/bounties/f3b048b8-7f4e-45ef-a5a7-cb841c39acde'
tags:
  - osv
  - pip
epss: 0.00298
epssPercentile: 0.22694
ingestedAt: '2026-07-13T18:57:56.918Z'
---

## Overview

A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field. The `reference` field is concatenated directly into a `git clone` command string without proper sanitization, and then parsed by `shlex.split()`. This enables injection of options such as `-c`, leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execution (RCE). The vulnerability affects both the `aget_directory()` and `get_directory()` methods in `src/integrations/prefect-github/prefect_github/repository.py`. This issue does not affect the GitLab and BitBucket integrations, which use a safer list-based command construction approach.

## Affected packages

- `prefect <= 3.6.18`

## Remediation

Refer to the advisory for the patched release.