CVE-2026-70375

HashBrown CMS <= 1.4.6 contains an OS Command Injection in the Git deployer (GitDeployer.pullRepo) where the branch value is interpolated into a shell command: git checkout ${this.branch || 'master'}. Validation only rejects single quotes; shell metacharacters such as ;, &&, |, backticks, and ...

EUVD-2026-53098

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.execgit checkout $this.branch || 'master', interpolating the configured branch value directly into...