Executive brief
Prefect is a workflow orchestration platform used to manage and automate data pipelines. A vulnerability in its Git repository handling allows an attacker to inject malicious commands by manipulating specific Git-related parameters. This could allow an attacker to interfere with automated workflows or potentially gain unauthorized access to the environment where these tasks are executed.
Technical details
An argument injection vulnerability exists in Prefect's GitRepository Pull Handler within 'src/prefect/runner/storage.py'. The issue stems from improper neutralization of special elements in the 'commit_sha' and 'directories' arguments used during Git pull steps. A remote attacker with low privileges can exploit this by providing crafted input that is interpreted as command-line arguments by the underlying Git process. This can lead to unauthorized code execution or data manipulation within the runner's context. The vulnerability is addressed in version 3.6.25.dev7.
Affected products
- PrefectHQ prefect < 3.6.25.dev7
Timeline
- 2026-05-04: disclosed
- 2026-05-04: advisory
- 2026-05-22: patched: GitHub advisory reviewed and patch confirmed.