CVE-2026-3515
A vulnerability in the block of the integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the field.
Published May 24, 2026 · updated Jul 23, 2026
A vulnerability in the block of the integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the field. The field is concatenated directly into a command string without proper sanitization, and then parsed by . This enables injection of options such as , leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execution (RCE). The vulnerability affects both the and methods in . This issue does not affect the GitLab and BitBucket integrations, which use a safer list-based command construction approach.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 24, 2026 · NIST NVD
Detected
A vulnerability in the block of the integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the field. The field is concatenated directly into a command string without proper sanitization, and then parsed by . This enables injection of options such as , leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execut
Jul 23, 2026 · NIST NVD
Updated
A vulnerability in the block of the integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the field. The field is concatenated directly into a command string without proper sanitization, and then parsed by . This enables injection of options such as , leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execut
Sources
- CVE.orgVulnerability recordCVE-2026-3515
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3515
A vulnerability in the block of the integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the field. The field is concatenated directly into a command strin
nvd.nist.gov