CVE-2026-70375

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70375", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-04T07:13:07.993Z", "datePublished": "2026-08-05T05:46:26.004Z", "dateUpdated": "2026-08-10T11:44:50.835Z"}, "containers": {"cna": {"title": "HashBrown CMS - OS Command Injection via Git Deployer Branch Field", "descriptions": [{"lang": "en", "value": "HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78 OS Command Injection", "cweId": "CWE-78", "type": "CWE"}]}], "affected": [{"vendor": "HashBrownCMS", "product": "hashbrown-cms", "repo": "https://github.com/HashBrownCMS/hashbrown-cms", "programFiles": ["src/Server/Entity/Deployer/GitDeployer.js"], "versions": [{"version": "0", "lessThanOrEqual": "1.4.6", "versionType": "semver", "status": "affected"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/HashBrownCMS/hashbrown-cms", "tags": ["third-party-advisory"]}, {"url": "https://cve.turansec.uz/advisories/TRN-B571F773", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alijonov Alisher", "type": "finder"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:50.835Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T05:46:26.004Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:01:05.661783Z", "id": "CVE-2026-70375", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:03:00.979Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70375", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:01:05.661783Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:02:57.791Z"}}], "cna": {"title": "HashBrown CMS - OS Command Injection via Git Deployer Branch Field", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alijonov Alisher"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/HashBrownCMS/hashbrown-cms", "vendor": "HashBrownCMS", "product": "hashbrown-cms", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.6"}], "programFiles": ["src/Server/Entity/Deployer/GitDeployer.js"], "defaultStatus": "unknown"}], "datePublic": "2026-08-05T05:46:26.004Z", "references": [{"url": "https://github.com/HashBrownCMS/hashbrown-cms", "tags": ["third-party-advisory"]}, {"url": "https://cve.turansec.uz/advisories/TRN-B571F773", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.", "supportingMedia": [{"type": "text/html", "value": "<p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 OS Command Injection"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:50.835Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70375", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:44:50.835Z", "dateReserved": "2026-08-04T07:13:07.993Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T05:46:26.004Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "hashbrown-cms", "programFiles": ["src/Server/Entity/Deployer/GitDeployer.js"], "repo": "https://github.com/HashBrownCMS/hashbrown-cms", "vendor": "HashBrownCMS", "versions": [{"lessThanOrEqual": "1.4.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping."}, {"lang": "es", "value": "HashBrown CMS hasta la versi\u00f3n 1.4.6 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo (CWE-78) en el componente de despliegue de Git. GitDeployer.pullRepo() en src/Server/Entity/Deployer/GitDeployer.js ejecuta AppService.exec(\u2019git checkout ${this.branch || \u2019master\u2019}\u2019), interpolando el valor de la rama configurada directamente en un comando de shell sin escape. GitDeployer.validate() solo rechaza un car\u00e1cter de comilla simple en los campos de repositorio, rama, nombre de usuario y contrase\u00f1a; los metacaracteres de shell como \u2019;\u2019, \u2019 y y \u2019, \u2019|\u2019, backticks y \u2019$()\u2019 no se filtran. Un usuario capaz de configurar los ajustes del desplegador de Git de un proyecto puede establecer un valor de rama malicioso (por ejemplo, \u2019master;[command]#\u2019) que se ejecuta autom\u00e1ticamente en cada operaci\u00f3n de despliegue posterior (carga de medios, guardado de contenido, etc.), ya que pullRepo() se invoca incondicionalmente al inicio de cada una de dichas operaciones. Esto est\u00e1 relacionado con CVE-2020-6948, que abord\u00f3 el escape de comillas simples de los campos de repositorio, nombre de usuario y contrase\u00f1a en la invocaci\u00f3n de git clone del mismo archivo; el campo de rama utilizado en el comando git checkout sin comillas no fue cubierto por esa correcci\u00f3n y sigue siendo inyectable."}], "id": "CVE-2026-70375", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70375", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:01:05.661783Z", "version": "2.0.3"}}]}, "published": "2026-08-05T07:16:39.697", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://cve.turansec.uz/advisories/TRN-B571F773"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/HashBrownCMS/hashbrown-cms"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.4.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hashbrown-cms", "source": "cna", "vendor": "HashBrownCMS"}, "product": "hashbrown_cms", "vendor": "hashbrowncms"}], "created": "2026-08-05T07:45:03.642126+00:00", "updated": "2026-08-10T22:15:03.872252+00:00", "vendors": ["hashbrowncms", "hashbrowncms$PRODUCT$hashbrown_cms"]}