PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45626 getarcaneapp CVE debrief

Arcane versions 1.18.1 and earlier contain a command injection vulnerability in the volume browsing endpoint. The GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is passed unsafely into a shell command executed within an Arcane helper container. While the application implements path traversal protection by blocking ../ sequences, the sanitization fails to neutralize Bourne-shell metacharacters including command substitution syntax ($() and backticks). The strconv.Quote function used for escaping only addresses Go string metacharacters, not shell-specific substitution sequences. Any authenticated user with access to a browseable volume can leverage this flaw to execute arbitrary commands inside the helper container. Command output is reflected in HTTP 500 error responses, providing direct feedback for injection attempts. The vulnerability is classified as CWE-78 (OS Command Injection) with a CVSS 3.1 score of 6.3 (Medium severity). The issue was disclosed via GitHub Security Advisory and entered into the CVE program on May 29, 2026.

Vendor
getarcaneapp
Product
arcane
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-05-29
Advisory published
2026-05-29
Advisory updated
2026-05-29

Who should care

Organizations running Arcane 1.18.1 or earlier for Docker container management; security teams responsible for container orchestration platform hardening; developers maintaining applications that construct shell commands from user input

Technical summary

The vulnerability exists in the volume browsing functionality where user-supplied path parameters are concatenated into shell commands. The application's defense-in-depth approach using strconv.Quote and directory traversal blocking is insufficient because it does not account for shell command substitution syntax. An attacker with valid credentials and volume access can inject commands through the path parameter, which execute within the context of the Arcane helper container. The 500 error response behavior provides output reflection that could facilitate blind command execution confirmation.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Arcane to a version later than 1.18.1 that properly sanitizes shell metacharacters in the path parameter
  • Implement input validation that explicitly rejects command substitution characters including $(), backticks, and other shell metacharacters before passing user input to shell commands
  • Consider replacing shell command execution with direct filesystem API calls to eliminate the injection surface entirely
  • Review all endpoints that accept path parameters for similar sanitization gaps
  • Monitor application logs for suspicious path parameters containing shell metacharacters
  • Restrict network access to Arcane management interfaces to authorized administrative hosts only
  • Enable comprehensive audit logging for volume browse operations to detect potential exploitation attempts

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Technical details regarding path sanitization bypass and shell metacharacter handling confirmed through GitHub Security Advisory GHSA-9mvm-4gwg-v8mp. CVSS vector and CWE classification obtained from NVD metadata.

Official resources

2026-05-29