An ingestion path vulnerability in Prefect allows an attacker who can authenticate to the Prefect server to inject arbitrary arguments into the git_clone pull step. The branch field is passed to the underlying git pull command without any sanitization, enabling the execution of arbitrary git commands and therefore remote code execution on the Prefect host. The flaw fulfills the criteria of CWE‑88, Argument Injection.

PrefectHQ’s Prefect flows are impacted. All versions prior to the fix are vulnerable, as the injection point resides in the branch parameter handling code of the git_clone step. Versions that have received the fix are no longer affected.

The CVSS base score of 8.8 reflects a high severity in terms of both confidentiality and availability. Because EPSS data is not published, the exact likelihood of exploitation in the wild is unknown, but the absence of a KEV listing does not preclude a potential active target. The attack requires a legitimate Prefect user account; once authenticated, the attacker can manipulate the branch field to deliver malicious git arguments that execute on the appliance. No additional mitigations are required beyond the vendor fix, as the flaw is not exploitable without server‑side permission.