Executive brief
Prefect is a workflow orchestration platform used to manage and automate data pipelines. A security flaw in its GitHub integration allows an attacker to manipulate how the system interacts with GitHub repositories. This could lead to unauthorized access to sensitive credentials, internal network scanning, or the ability to run malicious code on the server hosting the Prefect workflows.
Technical details
An argument injection vulnerability (CWE-88) exists in the `GitHubRepository` block of the `prefect-github` integration. The root cause is the improper sanitization of the `reference` field, which is directly concatenated into a `git clone` command string before being parsed by `shlex.split()`. An attacker with low privileges can inject arbitrary git options, such as `-c`, to manipulate command execution. This affects both the `aget_directory()` and `get_directory()` methods in `repository.py`. Successful exploitation can result in SSRF, credential theft, or remote code execution (RCE). As of the advisory date, no patched version is specified for the 3.6.18 branch.
Affected products
- PrefectHQ Prefect <= 3.6.18
Timeline
- 2026-05-24: disclosed: NVD Published Date
- 2026-05-26: advisory: GitHub Advisory published