CVE-2026-92892 PUBLISHED

Potential command execution on the host running JFrog CLI.

Assigner: JFROG
Reserved: 17.09.2026 Published: 13.10.2026 Updated: 13.10.2026

Potential arbitrary code execution, under specific configurations.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9

Product Status

Vendor jfrog
Product jfrog-cli
Versions Default: unaffected
  • affected from 0 to 2.126.0 (incl.)

Credits

  • nadavgb (reported via HackerOne) finder

References

Problem Types

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE