Description
Potential arbitrary code execution under specific configurations.
Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jfrog | jfrog-cli | < 2.128.0 | 2.128.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jfrog-cli | 2.127.0-1.1 | openSUSE-SU-2026:12130-1 |
Advisories 1
- openSUSE-SU-2026:12130-1 jfrog-cli-2.127.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 15, 2026
References
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories vendor-advisory
- https://github.com/jfrog/jfrog-cli/releases vendor-advisory