Technical impact
According to the updated description, HashBrown CMS versions up to 1.4.6 contain an OS Command Injection flaw in the Git deployer. The vulnerability arises because the configured Git branch name is directly inserted into a shell command without any sanitization. An attacker who can set the branch field can inject shell metacharacters, causing arbitrary commands to execute when the deployer performs a checkout during routine operations such as media uploads or content saves. The flaw is identified as CWE‑78.
Affected Systems
Impacted are installations of HashBrown CMS that use the Git deployer feature. Any deployment environment running HashBrown CMS version 1.4.6 or earlier is vulnerable, regardless of the underlying operating system. The issue was present before the release of 1.4.6 and 1.4.6 itself carries the flaw; no later fixed version is listed in the provided data.
Risk and Exploitability
The EPSS score is <1%, but the CVSS score of 8.8 highlights a high severity OS Command Injection risk. The vulnerability can be exploited only when an attacker has the ability to modify the project's Git deployer configuration. If such privileges are available, arbitrary code execution on the hosting server is possible, providing full system compromise. This flaw is not listed in CISA KEV, indicating no known widespread exploitation, but the absence of mitigations such as input validation and the unconditional execution of the checkout command make it a high‑risk issue. Immediate patching or mitigation is recommended to prevent potential compromise.
