CVE-2026-7725: PrefectHQ prefect GitRepository Pull storage.py argument injection
A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6. Affected by this issue is some unknown functionality of the file src/prefect/runner/storage.py of the component GitRepository Pull Handler. The manipulation of the argument commitsha/directories results in argument injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 3.6.25.dev7 can resolve this issue. The patch is identified as 6a9d9918716ce4ee0297b69f3046f7067ef1faae. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PrefectHQ prefect GitRepository Pull Handlerto a version that resolves this vulnerability.Fixed in 3.6.25.dev7Patch 6a9d9918716ce4ee0297b69f3046f7067ef1faae
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7725?
CVE-2026-7725 has been classified as a high severity vulnerability due to the potential for argument injection in the GitRepository Pull Handler.
How do I fix CVE-2026-7725?
To fix CVE-2026-7725, upgrade to Prefect version 3.6.25.dev7 or later where the vulnerability has been addressed.
What impact can CVE-2026-7725 have on my application?
CVE-2026-7725 can allow an attacker to inject arbitrary arguments, potentially leading to unauthorized actions or data exposure.
Which versions of Prefect are affected by CVE-2026-7725?
CVE-2026-7725 affects PrefectHQ prefect versions up to and including 3.6.25.dev6.
Where can I find more information on CVE-2026-7725?
For more details on CVE-2026-7725, refer to the official CVE description and security advisories.