Prefect Git Argument Injection in GitRepository Pull Steps

A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6. Affected by this issue is some unknown functionality of the file src/prefect/runner/storage.py of the component GitRepository Pull Handler. The manipulation of the argument commitsha/directories results in argument injection. It is...

edx-prefectutils (>=1.0.7, <=2.0.0) potentially affected by CVE-2026-7725 via prefect (0.14.5)

prefect PYPI version 0.14.5 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - edx-prefectutils =1.0.7, =2.0.0 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

kubernetes-watch (>=0.1.1, <=0.1.2) potentially affected by CVE-2026-7725 via prefect (2.18.0)

prefect PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - kubernetes-watch =0.1.1, =0.1.2 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

assemblit (>=0.1.11, <=0.1.13) potentially affected by CVE-2026-7725 via prefect (2.16.6)

prefect PYPI version 2.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - assemblit =0.1.11, =0.1.13 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

kitanaqa (0.1.0) potentially affected by CVE-2026-7725 via prefect (0.13.4)

prefect PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - kitanaqa 0.1.0 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

simmate (>=0.7.0, <=0.7.1) potentially affected by CVE-2026-7725 via prefect (2.0.0b8)

prefect PYPI version 2.0.0b8 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - simmate =0.7.0, =0.7.1 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

softpack-builder (0.1.0), softpack-core (0.1.0) potentially affected by CVE-2026-7725 via prefect (2.8.6)

prefect PYPI version 2.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - softpack-builder 0.1.0 - softpack-core 0.1.0 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

ai-24sea (>=0.1.0, <=1.1.1), ai-documentation-writer (>=0.1.0, <=0.1.1) +33 more potentially affected by CVE-2026-7725 via prefect (>=3.0.0rc20, <=3.6.24)

prefect PYPI version =3.0.0rc20, =0.1.0, =0.1.0, =0.16.0, =1.0.1, =2.2.8, =2.25.0rc1, =0.1.31, =1.1.0b2, =1.3.0b5, =0.0.2, =0.1.11, =1.1.0, =3.0.0, =3.3.0 and more Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

cvapipe-analysis (0.1.4) potentially affected by CVE-2026-7725 via prefect (0.14.15)

prefect PYPI version 0.14.15 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cvapipe-analysis 0.1.4 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

cmip6-downscaling (1.1.1), cupyopt (>=0.15.13.1, <=0.15.13.2) +4 more potentially affected by CVE-2026-7725 via prefect (0.15.13)

prefect PYPI version 0.15.13 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cmip6-downscaling 1.1.1 - cupyopt =0.15.13.1, =0.1.8, =0.1.0, =0.1.10a0 - soam 0.10.2 Source cves: CVE-2026-7725 Source advisory:...

investigraph (>=0.3.2, <=0.5.2) potentially affected by CVE-2026-7725 via prefect (2.16.8)

prefect PYPI version 2.16.8 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - investigraph =0.3.2, =0.5.2 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

abm-colony-collection (>=0.1.0, <=0.5.0), abm-initialization-collection (>=0.1.0, <=0.7.0) +52 more potentially affected by CVE-2026-7725 via prefect (2.82.0)

prefect PYPI version 2.82.0 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - abm-colony-collection =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0b0, =2.6.0, =0.1.4, =0.1.0, =1.0.2, =2.30.1, =0.1.0, =1.0.0, =4.0.0 and more Source...

prefect-ds (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-7725 via prefect (0.9.2)

prefect PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-ds =0.1.0, =0.1.1 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

simmate (>=0.8.0, <=0.9.0) potentially affected by CVE-2026-7725 via prefect (2.0.4)

prefect PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - simmate =0.8.0, =0.9.0 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

archimedes-flow-utils (>=1.0.4, <=1.1.8), archimedes-python-client (>=3.4.0, <=3.8.1) +11 more potentially affected by CVE-2026-7725 via prefect (1.4.1)

prefect PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - archimedes-flow-utils =1.0.4, =3.4.0, =0.1.0, =1.0.21, =0.1.0, =1.0.0, =2.3.9, =0.0.0b1, =0.2.1, =0.0.0, =2021.12.16, =2021.12.17 Source cves:...

aporacle (>=0.0.126, <=0.0.143), komoutils (>=0.0.217, <=0.0.224) potentially affected by CVE-2026-7725 via prefect (2.10.0)

prefect PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - aporacle =0.0.126, =0.0.217, =0.0.224 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

mesiqi (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-7725 via prefect (0.15.7)

prefect PYPI version 0.15.7 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - mesiqi =0.0.1, =0.0.2 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

infractl (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-7725 via prefect (2.13.0)

prefect PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - infractl =0.0.1, =0.0.3 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

cupyopt (>=0.15.11.1, <=0.15.11.2), exactonline-prefect-tasks (>=0.0.5, <=0.0.26) +6 more potentially affected by CVE-2026-7725 via prefect (0.15.11)

prefect PYPI version 0.15.11 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cupyopt =0.15.11.1, =0.0.5, =0.0.4, =0.0.4, =0.0.2, =0.0.14, =0.0.15 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...

cupyopt (0.14.11.1), fantasy-analysis (>=0.0.0, <=0.0.3) potentially affected by CVE-2026-7725 via prefect (0.14.11)

prefect PYPI version 0.14.11 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cupyopt 0.14.11.1 - fantasy-analysis =0.0.0, =0.0.3 Source cves: CVE-2026-7725 Source advisory: OSV:PYSEC-2026-2955...