CVE-2026-70375 in HashBrown
Summary
by MITRE • 08/05/2026
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(`git checkout ${this.branch || 'master'}`), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such as ';', '&&', '|', backticks, and '$()' are not filtered. A user able to configure a project's Git deployer settings can set a malicious branch value (e.g. 'master;<command>#') that executes automatically on every subsequent deployer operation (media upload, content save, etc.), since pullRepo() is invoked unconditionally at the start of each such operation. This is related to CVE-2020-6948, which addressed single-quote escaping of the repo, username, and password fields in the same file's git clone invocation; the branch field used in the unquoted git checkout command was not covered by that fix and remains injectable.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The HashBrown CMS version 1.4.6 and earlier contains a critical operating system command injection vulnerability classified as CWE-78 within its Git deployer component. This vulnerability exists in the GitDeployer.pullRepo() function located in src/Server/Entity/Deployer/GitDeployer.js where the system executes shell commands without proper input sanitization. The specific flaw occurs when the application constructs a git checkout command by directly interpolating user-supplied branch values into the shell execution string AppService.exec(`git checkout ${this.branch || 'master'}`) without any form of shell escaping or parameter validation.
The vulnerability's exploitation potential stems from insufficient input validation within the GitDeployer.validate() method which only filters out single-quote characters from sensitive fields including repository, branch, username, and password. However, this validation fails to address other dangerous shell metacharacters such as semicolons, logical operators, pipes, backticks, and command substitution syntax that could enable arbitrary code execution when processed by the underlying shell. This incomplete filtering creates a persistent attack vector that allows malicious actors with project configuration privileges to inject malicious commands through the branch field parameter.
The operational impact of this vulnerability is severe as it enables automatic code execution during routine deployment operations without requiring additional user interaction or authentication. Every time a deployer operation occurs such as media uploads, content saves, or other administrative tasks, the pullRepo() function executes unconditionally at the beginning of these processes, providing an ideal environment for persistent command injection attacks. The vulnerability affects all users who can configure Git deployer settings for projects, making it particularly dangerous in multi-user environments where privilege escalation might be possible through configuration modifications.
The attack scenario begins with an authenticated user modifying the branch field in Git deployer settings to include malicious shell commands such as 'master;<command>#', where the semicolon allows command chaining and the hash symbol comments out remaining command text. When subsequent deployment operations occur, the system automatically executes these injected commands within the context of the application's execution environment, potentially allowing attackers to gain unauthorized access, escalate privileges, or compromise the entire system. This vulnerability represents a regression from CVE-2020-6948 which addressed similar issues in git clone operations but failed to cover the branch field in git checkout commands.
Security mitigation strategies should prioritize immediate patching of affected systems and implementation of comprehensive input validation across all user-supplied parameters that may influence shell command execution. Organizations should enforce strict parameter sanitization, implement proper shell escaping mechanisms, and consider adopting secure coding practices such as using parameterized commands instead of string interpolation. Additionally, access controls should be strengthened to limit project configuration privileges to only trusted administrators, while monitoring systems should be deployed to detect anomalous deployment activities that might indicate exploitation attempts. The vulnerability's classification under CWE-78 underscores the importance of following defensive programming principles and implementing proper input validation to prevent unauthorized command execution in application contexts that interact with operating system processes.