The vulnerability stems from the --commit‑hash CLI option in the wrangler pages deploy command, which concatenates the supplied value directly into a shell command without validation or sanitization. This omission permits an attacker who can influence the --commit‑hash parameter to inject shell metacharacters and execute arbitrary commands on the system running Wrangler. The primary consequence is the ability to run arbitrary shell commands, exfiltrate sensitive data, or compromise the CI runner, potentially resulting in full system compromise for the build environment.

The flaw affects all Cloudflare Wrangler releases prior to v4.59.1, v3.114.17, and v2 (which is end‑of‑life). Users employing earlier major versions are vulnerable when using wrangler pages deploy within automated pipelines where --commit‑hash may originate from untrusted sources. The fix is available in Wrangler v4.59.1 and later, v3.114.17 and later, and any supported major release beyond v2.

The CVSS score of 7.7 indicates high severity, but the EPSS score of <1% signals a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no known large‑scale attacks. The likely attack vector is a compromised or poorly configured CI/CD pipeline that supplies an attacker‑controlled value to the --commit‑hash option. Successful exploitation would require the attacker to have influence over the CI environment, which is a moderate to high limitation for most users. Nonetheless, the ability to execute arbitrary commands poses a serious threat to confidentiality, integrity, and availability of the build system.