CVE-2026-92892
Description
A flaw was found in JFrog CLI. Under specific configurations, a remote attacker can achieve arbitrary code execution on the host running the utility by exploiting improper command argument handling. Successful exploitation allows the attacker to run unauthorized commands within the context of the host environment.
Statement
A critical command-execution flaw was found in JFrog CLI. Red Hat provides this utility only through the Fedora and EPEL community projects; it is not shipped in Red Hat Enterprise Linux. Under specific configurations, a remote attacker can exploit improper command argument handling to achieve arbitrary code execution on the host running the utility, allowing unauthorized commands to run in the context of the host environment. The issue is rated critical with a CVSS 3.1 score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), where the high attack complexity reflects that exploitation depends on specific configurations. The affected Fedora and EPEL packages are handled through the community (delegated) process, and a fix is being pursued there; the Red Hat severity matches the upstream rating.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
