The vulnerability resides in the GitHubRepository block of the prefect-github integration, where the reference field is directly concatenated into a git clone command string without sanitization. After building the command, shlex.split() parses it, allowing an attacker to inject arbitrary git options such as -c. This injection can lead to Server‑Side Request Forgery, credential theft, or in the worst case remote code execution. The flaw is a classic argument‑injection problem identified as CWE‑88.

The affected product is Prefect, specifically the prefecthq/prefect GitHub integration, version 3.6.18. Only the GitHub integration is vulnerable; GitLab and BitBucket integrations use safer, list‑based command construction and are not impacted.

The flaw receives a CVSS score of 8.5, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote or via malicious configuration: an attacker who supplies a crafted reference string can trigger the vulnerable command during repository cloning, potentially enabling SSRF, credential leakage, or RCE. No exploitation evidence is reported, but the high severity and the nature of the flaw warrant immediate attention.