{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70375", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-04T07:13:07.993Z", "datePublished": "2026-08-05T05:46:26.004Z", "dateUpdated": "2026-08-05T05:46:26.004Z"}, "containers": {"cna": {"title": "HashBrown CMS: OS Command Injection via Git Deployer Branch Field", "descriptions": [{"lang": "en", "value": "HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(`git checkout ${this.branch || 'master'}`), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such as ';', '&&', '|', backticks, and '$()' are not filtered. A user able to configure a project's Git deployer settings can set a malicious branch value (e.g. 'master;<command>#') that executes automatically on every subsequent deployer operation (media upload, content save, etc.), since pullRepo() is invoked unconditionally at the start of each such operation. This is related to CVE-2020-6948, which addressed single-quote escaping of the repo, username, and password fields in the same file's git clone invocation; the branch field used in the unquoted git checkout command was not covered by that fix and remains injectable."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78 OS Command Injection", "cweId": "CWE-78", "type": "CWE"}]}], "affected": [{"vendor": "HashBrownCMS", "product": "hashbrown-cms", "repo": "https://github.com/HashBrownCMS/hashbrown-cms", "programFiles": ["src/Server/Entity/Deployer/GitDeployer.js"], "versions": [{"version": "0", "lessThanOrEqual": "1.4.6", "versionType": "semver", "status": "affected"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/HashBrownCMS/hashbrown-cms"}, {"url": "https://cve.turansec.uz/advisories/TRN-B571F773"}], "credits": [{"lang": "en", "value": "Alijonov Alisher", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-05T05:46:26.004Z"}}}}

{}

{}

{}

{}