CVE-2026-92892: Potential command execution on the host running JFrog CLI.
Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JFrog CLIto a version that resolves this vulnerability.Fixed in v2.128.0
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No privileges or user interaction are required according to the supplied vector. However, exploitation has high attack complexity and is limited to specific configurations.
Are default JFrog CLI installations known to be affected?
The available information only states that specific configurations are affected. It does not identify the affected configurations or confirm whether the default configuration is vulnerable.
What is the expected security impact if exploitation succeeds?
The supplied vector indicates high impact to confidentiality, integrity, and availability, with scope changed. The issue is rated critical.
Is there a documented workaround or detection method if patching cannot happen immediately?
No workaround, detection guidance, or fixed version is provided in the available data. The referenced JFrog security advisories and JFrog CLI release information are the indicated sources for remediation details.