CVE-2026-92892 Potential command execution on the host running JFrog CLI.
Attackers can execute arbitrary commands on the host running JFrog CLI under specific configurations, requiring a patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92892?
CVE-2026-92892 is a critical command injection vulnerability in jfrog-cli, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
Weakness: CWE-88
Which versions are affected by CVE-2026-92892?
Linux distribution packages (1)
jfrog-cli openSUSE:Tumbleweed | All versions | 2.127.0-1.1 |
How do I fix CVE-2026-92892?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-92892 being exploited?
There is no known exploitation of CVE-2026-92892 in the wild and no public exploit code.
Sources
Also known as GHSA-xq2g-wqh2-pq6f, openSUSE-SU-2026:12130-1.