https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 01:46:57 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-70375 <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.</p> <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.</p> https://db.gcve.eu/vuln/fkie_cve-2026-70375 https://db.gcve.eu/vuln/ghsa-h9gr-58w4-64cq <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(`git checkout ${this.branch || &#39;master&#39;}`), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such as &#39;;&#39;, &#39;&amp;&amp;&#39;, &#39;|&#39;, backticks, and &#39;$()&#39; are not filtered. A user able to configure a project&#39;s Git deployer settings can set a malicious branch value (e.g. &#39;master;&lt;command&gt;#&#39;) that executes automatically on every subsequent deployer operation (media upload, content save, etc.), since pullRepo() is invoked unconditionally at the start of each such operation. This is related to CVE-2020-6948, which addressed single-quote escaping of the repo, username, and password fields in the same file&#39;s git clone invocation; the branch field used in the unquoted git checkout command was not covered by that fix and remains injectable.</p> <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(`git checkout ${this.branch || &#39;master&#39;}`), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such as &#39;;&#39;, &#39;&amp;&amp;&#39;, &#39;|&#39;, backticks, and &#39;$()&#39; are not filtered. A user able to configure a project&#39;s Git deployer settings can set a malicious branch value (e.g. &#39;master;&lt;command&gt;#&#39;) that executes automatically on every subsequent deployer operation (media upload, content save, etc.), since pullRepo() is invoked unconditionally at the start of each such operation. This is related to CVE-2020-6948, which addressed single-quote escaping of the repo, username, and password fields in the same file&#39;s git clone invocation; the branch field used in the unquoted git checkout command was not covered by that fix and remains injectable.</p> https://db.gcve.eu/vuln/ghsa-h9gr-58w4-64cq