getarcaneapp arcane up to 1.12.x Updater Service os command injection

Summaryinfo

A vulnerability labeled as critical has been found in getarcaneapp arcane up to 1.12.x. This issue affects some unknown processing of the component Updater Service. The manipulation results in os command injection. This vulnerability is known as CVE-2026-23520. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in getarcaneapp arcane up to 1.12.x. Affected is an unknown part of the component Updater Service. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-23520 since 01/13/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 1.13.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• getarcaneapp

Name

• arcane

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12

Website

• Product: https://github.com/getarcaneapp/arcane/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion