high8.8
CVE-2026-72538
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step …
Impact
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.
Affected products
| Product | Affected versions |
|---|---|
| PrefectHQ Prefect | through 3.8.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.