# CVE-2026-7725: Prefect Git argument injection in GitRepository Pull Handler

Source: https://junglewise.ai/threats/cve-2026-7725-prefect-git-argument-injection-in-gitrepository-pull-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-22  
License: CC BY 4.0 with a link back

CVE-2026-7725 · Severity: medium · CVSS 6.3 · Published 2026-05-04

Prefect is a workflow orchestration platform used to manage and automate data pipelines. A vulnerability in its Git repository handling allows an attacker to inject malicious commands by manipulating specific Git-related parameters. This could allow an attacker to interfere with automated workflows or potentially gain unauthorized access to the environment where these tasks are executed.

Technologies: [prefect (PyPI)](https://junglewise.ai/threats/technologies/prefect). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-7725 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7725 being exploited in the wild.

**How severe is CVE-2026-7725?** Medium severity, with a CVSS score of 6.3, published 4 May 2026.

**Which products and versions are affected?** prefect (PyPI) < 3.6.25.dev7, ECOSYSTEM:introduced=0,fixed=3.6.25.dev7.

**Is there a fix for CVE-2026-7725?** Yes. prefect (PyPI): upgrade to 3.6.25.dev7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7725 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7725?** Check whether you run prefect (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- prefect (PyPI): upgrade to 3.6.25.dev7 or later

  ```sh
  pip install "prefect>=3.6.25.dev7"
  ```


## Technical details

An argument injection vulnerability exists in Prefect's GitRepository Pull Handler within 'src/prefect/runner/storage.py'. The issue stems from improper neutralization of special elements in the 'commit_sha' and 'directories' arguments used during Git pull steps. A remote attacker with low privileges can exploit this by providing crafted input that is interpreted as command-line arguments by the underlying Git process. This can lead to unauthorized code execution or data manipulation within the runner's context. The vulnerability is addressed in version 3.6.25.dev7.

## Affected products

- PrefectHQ prefect < 3.6.25.dev7

## Identifiers

- CVE-2026-7725
- GHSA-6rcx-55r6-jx65
- PYSEC-2026-2955

## Timeline

- 2026-05-04: disclosed
- 2026-05-04: advisory
- 2026-05-22: patched: GitHub advisory reviewed and patch confirmed.

## References

- [https://api.github.com/users/nedlir](https://api.github.com/users/nedlir)
- [https://github.com/nedlir](https://github.com/nedlir)
- [https://api.github.com/users/nedlir/gists%7B/gist_id%7D](https://api.github.com/users/nedlir/gists%7B/gist_id%7D)
- [https://api.github.com/users/nedlir/repos](https://api.github.com/users/nedlir/repos)
- [https://avatars.githubusercontent.com/u/66902031?v=4](https://avatars.githubusercontent.com/u/66902031?v=4)
- [https://api.github.com/users/nedlir/events%7B/privacy%7D](https://api.github.com/users/nedlir/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-1800 - Prefect CORS (Cross-Origin Resource Sharing) misconfiguration](https://junglewise.ai/threats/cve-2024-8183-prefect-cors-cross-origin-resource-sharing-misconfiguration)
- [PYSEC-2026-1799 - Cross-Site Request Forgery vulnerability in Prefect](https://junglewise.ai/threats/cve-2023-6022-cross-site-request-forgery-vulnerability-in-prefect)
- [Prefect remote code execution in GitRepository storage class](https://junglewise.ai/threats/cve-2026-5366-prefect-remote-code-execution-in-gitrepository-storage-class)
- [Prefect authentication bypass via health check path exemption](https://junglewise.ai/threats/cve-2026-3514-prefect-authentication-bypass-via-health-check-path-exemption)
- [Prefect prefect-github argument injection in GitHubRepository](https://junglewise.ai/threats/cve-2026-3515-prefect-prefect-github-argument-injection-in-githubrepository)