CVE-2026-70375 HashBrownCMS CVE debrief

Who should care

Users of HashBrown CMS through version 1.4.6 who utilize the Git deployer component should verify and restrict Git deployer settings and branch values to prevent potential OS command injection attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who are responsible for securing HashBrown CMS deployments.

Technical summary

The HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability in the Git deployer component. The vulnerability is caused by the insecure interpolation of the branch value into a shell command without proper escaping in the GitDeployer.pullRepo() function. This allows a user with the ability to configure a project's Git deployer settings to set a malicious branch value that executes automatically on every subsequent deployer operation. The vulnerability can be exploited by setting a malicious branch value, such as 'master;<command>#', which executes automatically on every subsequent deployer operation.

Defensive priority

Verify Git deployer settings and branch values for potential OS command injection vulnerabilities.

Recommended defensive actions

• Verify and restrict Git deployer settings and branch values.
• Implement proper input validation and escaping for branch values.
• Monitor deployer operations for suspicious activity.
• Update to a version of HashBrown CMS that addresses this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-70375 record indicates an OS Command Injection vulnerability in HashBrown CMS through 1.4.6, specifically in the Git deployer component. The vulnerability is due to the insecure interpolation of the branch value into a shell command without proper escaping. A user with the ability to configure a project's Git deployer settings can set a malicious branch value that executes automatically on every subsequent deployer operation.

Official resources