CVE-2026-23520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23520", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T18:22:43.980Z", "datePublished": "2026-01-15T19:20:22.434Z", "dateUpdated": "2026-01-15T19:58:45.182Z"}, "containers": {"cna": {"title": "Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8"}, {"name": "https://github.com/getarcaneapp/arcane/pull/1468", "tags": ["x_refsource_MISC"], "url": "https://github.com/getarcaneapp/arcane/pull/1468"}, {"name": "https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4", "tags": ["x_refsource_MISC"], "url": "https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4"}, {"name": "https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0"}], "affected": [{"vendor": "getarcaneapp", "product": "arcane", "versions": [{"version": "< 1.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-15T19:20:22.434Z"}, "descriptions": [{"lang": "en", "value": "Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane\u2019s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0."}], "source": {"advisory": "GHSA-gjqq-6r35-w3r8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T19:58:38.291447Z", "id": "CVE-2026-23520", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T19:58:45.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-15T19:58:38.291447Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T19:58:41.451Z"}}], "cna": {"title": "Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE", "source": {"advisory": "GHSA-gjqq-6r35-w3r8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getarcaneapp", "product": "arcane", "versions": [{"status": "affected", "version": "< 1.13.0"}]}], "references": [{"url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8", "name": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getarcaneapp/arcane/pull/1468", "name": "https://github.com/getarcaneapp/arcane/pull/1468", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4", "name": "https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0", "name": "https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane\u2019s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-15T19:20:22.434Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23520", "state": "PUBLISHED", "dateUpdated": "2026-01-15T19:58:45.182Z", "dateReserved": "2026-01-13T18:22:43.980Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-15T19:20:22.434Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "arcane", "vendor": "getarcaneapp", "versions": [{"status": "affected", "version": "< 1.13.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arcane:arcane:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6334A63-DF55-490B-9840-4805617B2E8D", "versionEndExcluding": "1.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane\u2019s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0."}, {"lang": "es", "value": "Arcane proporciona gesti\u00f3n moderna de Docker. Antes de 1.13.0, Arcane tiene una inyecci\u00f3n de comandos en el servicio de actualizaci\u00f3n. El servicio de actualizaci\u00f3n de Arcane soportaba etiquetas de ciclo de vida com.getarcaneapp.arcane.lifecycle.pre-update y com.getarcaneapp.arcane.lifecycle.post-update que permit\u00edan definir un comando para ejecutar antes o despu\u00e9s de una actualizaci\u00f3n de contenedor. El valor de la etiqueta se pasa directamente a /bin/sh -c sin saneamiento ni validaci\u00f3n. Debido a que cualquier usuario autenticado (no limitado a administradores) puede crear proyectos a trav\u00e9s de la API, un atacante puede crear un proyecto que especifica una de estas etiquetas de ciclo de vida con un comando malicioso. Cuando un administrador m\u00e1s tarde activa una actualizaci\u00f3n de contenedor (ya sea manualmente o mediante comprobaciones de actualizaci\u00f3n programadas), Arcane lee la etiqueta de ciclo de vida y ejecuta su valor como un comando de shell dentro del contenedor. Esta vulnerabilidad est\u00e1 corregida en 1.13.0."}], "id": "CVE-2026-23520", "lastModified": "2026-06-17T10:21:43.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23520", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T19:58:38.291447Z", "version": "2.0.3"}}]}, "published": "2026-01-15T20:16:05.467", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit"], "url": "https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/getarcaneapp/arcane/pull/1468"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-01-16T13:43:09.312237+00:00", "updated": "2026-06-18T13:45:05.935356+00:00", "vendors": ["getarcaneapp", "getarcaneapp$PRODUCT$arcane"]}