CVE-2026-7725

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-7725

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7725.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-7725

Aliases

Published

2026-05-04T03:00:17.845Z

Modified

2026-07-13T16:43:33.261370141Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

PrefectHQ prefect GitRepository Pull storage.py argument injection

Details

A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6. Affected by this issue is some unknown functionality of the file src/prefect/runner/storage.py of the component GitRepository Pull Handler. The manipulation of the argument commit_sha/directories results in argument injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 3.6.25.dev7 can resolve this issue. The patch is identified as 6a9d9918716ce4ee0297b69f3046f7067ef1faae. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-74",
        "CWE-88"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7725.json"
}

References

Affected packages

Git / github.com/prefecthq/prefect

Affected ranges

Type

GIT

Repo

https://github.com/prefecthq/prefect

Events

Introduced

86c2ab9feb32c75def7a4e01f8b2fac8afea12a9

Fixed

6a9d9918716ce4ee0297b69f3046f7067ef1faae

Fixed

34f66a7cfc986e5b47688ea8ea7a91f8fc58e01f

Database specific

{
    "extracted_events": [
        {
            "introduced": "3.6.25.dev6"
        },
        {
            "last_affected": "3.6.25.dev6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.6.25.dev6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7725.json"