Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-92892

Potential command execution on the host running JFrog CLI.

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 2.128.0
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.

Affected versions

  • jfrog jfrog-cli

    fixed in 2.128.0

References 2

docs.jfrog.com

GitHub · jfrog/jfrog-cli