CyberRota Analysis
AI-GeneratedHashBrown CMS versions up to 1.4.6 are vulnerable to an OS Command Injection in the Git deployer component, allowing an attacker to execute arbitrary commands by injecting malicious input into the branch configuration. This vulnerability can be exploited during deployer operations, potentially leading to unauthorized access or manipulation of the system. Organizations using HashBrown CMS, particularly those with user-configurable Git deployer settings, should prioritize patching this issue to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.