CVE-2026-0933 OS Command Injection in `wrangler pages deploy`
Attackers can execute arbitrary commands via the --commit-hash parameter in Wrangler pages deploy, primarily affecting CI/CD pipelines.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0933?
CVE-2026-0933 is a high-severity command injection vulnerability in Cloudflare Wrangler, published on 20 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler.
Root causeThe commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.
ImpactThis vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where `wrangler pages deploy` is used in automated pipelines and the
--commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
* Run any shell command. * Exfiltrate environment variables. * Compromise the CI runner to install backdoors or modify build artifacts.
Credits Disclosed responsibly by kny4hacker.
Mitigation * Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher. * Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher. * Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Weakness: CWE-20
Which versions are affected by CVE-2026-0933?
4 open source packages ship an affected version, including wrangler. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wrangler npm | From 2.0.15 | 3.114.17 |
wrangler npm | From 2.0.15 | 3.114.17 |
wrangler npm | From 4.0.0 | 4.59.1 |
wrangler npm | From 4.0.0 | 4.59.1 |
Products include Cloudflare Wrangler.
How do I fix CVE-2026-0933?
Upgrade wrangler to a fixed version for your release line: 3.114.17 or 4.59.1.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-0933 being exploited?
There is no known exploitation of CVE-2026-0933 in the wild and no public exploit code.
Other vulnerabilities in Cloudflare Wrangler
Sources
Also known as GHSA-36p8-mvp6-cv38.