{"id":"CVE-2026-92892","published":"2026-10-13T18:17:26.530","lastModified":"2026-10-16T16:22:43.160","description":"Potential arbitrary code execution, under specific configurations.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","tags":[]},{"url":"https://github.com/jfrog/jfrog-cli/releases","tags":[]}],"exploitRefs":[{"url":"https://github.com/jfrog/jfrog-cli/releases","tags":[]}],"hasPoc":true,"ai":{"summary":"CVE-2026-92892 is a critical vulnerability in command-line argument parsing that allows attackers to inject arbitrary arguments, potentially leading to arbitrary code execution when specific configurations are present. This flaw is particularly dangerous because it can be exploited remotely without authentication and can escalate to full system compromise.","exploitability":"Exploitation requires specific application configurations where command-line arguments are processed without proper sanitization, making it moderately difficult to exploit but achievable with a well-crafted attack vector that leverages the argument injection flaw.","blast_radius":"If exploited, this vulnerability could affect a wide range of applications that process command-line arguments, potentially allowing attackers to execute arbitrary code on affected systems with the privileges of the running process.","remediation":"Upgrade to version 2.590 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","cli","argument-injection","command-line"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:57:48.599Z"}}