High severity8.8NVD Advisory· Published Aug 5, 2026· Updated Aug 28, 2026

CVE-2026-70375

Description

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

HashBrownCMS/Hashbrown CMSllm-fuzzy
Range: <=1.4.6

Patches

Vulnerability mechanics

References

cve.turansec.uz/advisories/TRN-B571F773nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000