{"answers":{"affected":"3 open source packages ship an affected version, including github.com/getarcaneapp/arcane/backend. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-23520 in the wild and no public exploit code.","fix":"Upgrade github.com/getarcaneapp/arcane/backend to 0.0.0-20260114065515-5a9c2f92e11f or later.","what":"CVE-2026-23520 is a critical command injection vulnerability in getarcaneapp arcane, published on 15 Jan 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-23520 and fix it if it is affected.\n\nWhat it is: CVE-2026-23520 is a critical command injection vulnerability in getarcaneapp arcane, published on 15 Jan 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-23520 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/getarcaneapp/arcane/backend (Go): affected all versions; fixed in 0.0.0-20260114065515-5a9c2f92e11f\n- github.com/getarcaneapp/arcane/backend (Go): affected all versions; fixed in 0.0.0-20260114065515-5a9c2f92e11f\n- github.com/getarcaneapp/arcane/backend (Go): affected all versions; fixed in 0.0.0-20260114065515-5a9c2f92e11f\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-23520/ (Markdown: https://insights.sbomify.com/CVE-2026-23520/index.md)","id":"CVE-2026-23520","markdown":"https://insights.sbomify.com/CVE-2026-23520/index.md","name":"CVE-2026-23520","record":{"aliases":["GHSA-gjqq-6r35-w3r8","GO-2026-4320"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Docker management tool","requires_auth":"low_privilege","summary":"An authenticated user can inject shell commands via lifecycle labels, leading to remote code execution when an administrator triggers a container update.","user_interaction":"required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"arcane","vendor":"arcane"}],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"description":"Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":"2026-03-21","github_poc":2,"max_poc_stars":2,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-03-21T21:52:49Z","kind":"github_poc","ref":"https://github.com/Augmaster/POC-CVE-2026-23520","stars":2,"title":null},{"date":"2026-03-23T16:03:46Z","kind":"github_poc","ref":"https://github.com/cypher-21/CVE-2026-23520","stars":2,"title":"CVE-2026-23520 is a critical command injection vulnerability in Arcane, a modern Docker management platform. The flaw exists in the platform's updater service and allows for Remote Code Execution (RCE)"}],"tier":"poc_unverified"},"has_fix":true,"headline":"Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE","id":"CVE-2026-23520","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":3,"n_references":4,"next":{"headline":"Traccar vulnerable to Path Traversal and External Control of File Name or Path","id":"CVE-2026-23521"},"packages":[{"ecosystem":"Go","fixed":["0.0.0-20260114065515-5a9c2f92e11f"],"introduced":["0"],"last_affected":[],"package":"github.com/getarcaneapp/arcane/backend","purl":null,"source":"GHSA-gjqq-6r35-w3r8"},{"ecosystem":"Go","fixed":["0.0.0-20260114065515-5a9c2f92e11f"],"introduced":["0"],"last_affected":[],"package":"github.com/getarcaneapp/arcane/backend","purl":"pkg:golang/github.com/getarcaneapp/arcane/backend","source":"GHSA-gjqq-6r35-w3r8"},{"ecosystem":"Go","fixed":["0.0.0-20260114065515-5a9c2f92e11f"],"introduced":["0"],"last_affected":[],"package":"github.com/getarcaneapp/arcane/backend","purl":"pkg:golang/github.com/getarcaneapp/arcane/backend","source":"GO-2026-4320"}],"prev":{"headline":"RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz","id":"CVE-2026-23519"},"products":["arcane"],"published":"2026-01-15","related":[{"cvss_score":8,"headline":"Arcane allows unauthenticated proxy access to remote environments","id":"CVE-2026-23944","kev_date_added":null,"published":"2026-01-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-01-15","vendors":["getarcaneapp"]},"summary":"An authenticated user can inject shell commands via lifecycle labels, leading to remote code execution when an administrator triggers a container update.","url":"https://insights.sbomify.com/CVE-2026-23520/"}