Skip to content
OpenAdvisories

Package · PyPI

prefect

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.9
    CVE-2026-5366 Public exploit

    Git Argument Injection in prefecthq/prefect

    Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` sep…

    PrefectHQ prefecthq/prefect prefect PyPI