HashBrown CMS up to 1.4.6 Git Deployer GitDeployer.js GitDeployer.pullRepo branch os command injection

Summaryinfo

A vulnerability was found in HashBrown CMS up to 1.4.6. It has been rated as problematic. This issue affects the function GitDeployer.pullRepo of the file src/Server/Entity/Deployer/GitDeployer.js of the component Git Deployer. This manipulation of the argument branch causes os command injection. This vulnerability is handled as CVE-2026-70375. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in HashBrown CMS up to 1.4.6. It has been declared as problematic. Affected by this vulnerability is the function GitDeployer.pullRepo of the file src/Server/Entity/Deployer/GitDeployer.js of the component Git Deployer. The manipulation of the argument branch with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(`git checkout ${this.branch || 'master'}`), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such as ';', '&&', '|', backticks, and '$()' are not filtered. A user able to configure a project's Git deployer settings can set a malicious branch value (e.g. 'master;<command>#') that executes automatically on every subsequent deployer operation (media upload, content save, etc.), since pullRepo() is invoked unconditionally at the start of each such operation. This is related to CVE-2020-6948, which addressed single-quote escaping of the repo, username, and password fields in the same file's git clone invocation; the branch field used in the unquoted git checkout command was not covered by that fix and remains injectable.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-70375 since 08/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/05/2026). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• HashBrown

Name

• CMS

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion