CVE-2023-38646 Command injection in n/a
Unauthenticated attackers can execute arbitrary commands on the server via Metabase, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38646?
CVE-2023-38646 is a critical command injection vulnerability in n/a, published on 21 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
Which versions are affected by CVE-2023-38646?
It affects 1 product.
Products include Metabase Metabase.
How do I fix CVE-2023-38646?
No fix has been published for CVE-2023-38646 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-38646 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38646 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 37 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2026-72898 Metabase SQL Injection
- CVE-2021-41277 Metabase GeoJSON API Local File Inclusion
- CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- CVE-2023-37470 Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
- CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results
Sources
Also known as GHSA-jg32-8h6w-x7vg.