GHSA-6hw7-j4jw-wpff

Suggest an improvement
Source
https://github.com/advisories/GHSA-6hw7-j4jw-wpff
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6hw7-j4jw-wpff/GHSA-6hw7-j4jw-wpff.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6hw7-j4jw-wpff
Aliases
Published
2026-06-16T15:33:51Z
Modified
2026-07-13T16:42:52Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Galaxy NG: command injection vulnerability
Details

A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T20:48:05Z",
    "nvd_published_at": "2026-06-16T15:16:36Z",
    "severity": "HIGH"
}
References

Affected packages

PyPI / galaxy-ng

Package

Name
galaxy-ng
View open source insights on deps.dev
Purl
pkg:pypi/galaxy-ng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
4.9.2

Affected versions

4.*
4.2.0a3
4.2.0a4
4.2.0a5
4.2.0a6
4.2.0a7
4.2.0a8
4.2.0a9
4.2.0a10
4.2.0a12
4.2.0b1
4.2.0b2
4.2.0b3
4.2.0rc1
4.2.0rc2
4.2.0rc3
4.2.0
4.2.1
4.2.2
4.2.3b1
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0a1
4.3.0a2
4.3.0b4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.4.0a1
4.4.0a2
4.4.0b1
4.4.0b2
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.5.0b1
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.1
4.9.0
4.9.1
4.9.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6hw7-j4jw-wpff/GHSA-6hw7-j4jw-wpff.json"