CVE-2026-0933: Wrangler CLI Command Injection Vulnerability

CVE-2026-0933 Overview

A command injection vulnerability (CWE-78) has been discovered in the Cloudflare Wrangler CLI tool, specifically affecting the wrangler pages deploy command. The vulnerability exists because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of this parameter to execute arbitrary commands on the system running Wrangler.

This vulnerability primarily poses a risk to CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources.

Critical Impact

Attackers can execute arbitrary shell commands, exfiltrate environment variables, and compromise CI runners to install backdoors or modify build artifacts in automated deployment pipelines.

Affected Products

• Cloudflare Wrangler v4 (versions prior to v4.59.1)
• Cloudflare Wrangler v3 (versions prior to v3.114.17)
• Cloudflare Wrangler v2 (End of Life - no patch available)

Discovery Timeline

• 2026-01-20 - CVE-2026-0933 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0933

Vulnerability Analysis

This command injection vulnerability stems from improper input validation in the Wrangler CLI's page deployment functionality. The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals. When the shell executes this command, any metacharacters within the commitHash value are interpreted by the shell, enabling arbitrary command execution.

The attack requires network access and low privileges, but needs specific conditions to be met—namely, the attacker must have control over the --commit-hash parameter value. This makes CI/CD environments particularly vulnerable, as these systems often populate command parameters from external sources such as webhook payloads, environment variables, or repository metadata.

Root Cause

The root cause is the direct interpolation of user-supplied input into shell command execution. The commitHash variable is passed to shell execution functions (such as execSync) using template literals without any sanitization or escaping. For example, a pattern like execSync(git show -s --format=%B ${commitHash}) allows shell metacharacters within the commitHash value to be interpreted by the underlying shell, enabling command chaining or injection.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker must control the --commit-hash parameter, which is most likely in CI/CD pipeline scenarios where this value might be derived from:

• Webhook payloads from version control systems
• Environment variables set by external triggers
• User-controlled input in automated deployment scripts

By injecting shell metacharacters (such as ;, |, &&, or backticks) into the commit hash value, an attacker can break out of the intended git command and execute arbitrary shell commands with the privileges of the CI/CD runner process.

The vulnerability mechanism involves unsanitized user input being passed to shell execution. When the --commit-hash parameter contains shell metacharacters, these are interpreted by the shell rather than being treated as literal strings. For detailed technical implementation, refer to the Cloudflare Workers SDK repository.

Detection Methods for CVE-2026-0933

Indicators of Compromise

• Unexpected process spawning from Wrangler CLI execution contexts
• Anomalous network connections originating from CI/CD runner processes
• Environment variable access or exfiltration attempts during deployment jobs
• Modified build artifacts or unexpected file system changes on CI runners

Detection Strategies

• Monitor CI/CD logs for unusual --commit-hash parameter values containing shell metacharacters (;, |, &&, backticks, $())
• Implement input validation alerts for deployment commands receiving non-hexadecimal commit hash values
• Deploy endpoint detection on CI/CD runners to identify unexpected child processes spawned during Wrangler execution

Monitoring Recommendations

• Enable detailed logging for all wrangler pages deploy commands in CI/CD pipelines
• Monitor for outbound network connections from CI/CD runners that are not part of normal deployment operations
• Review CI/CD pipeline configurations to identify where --commit-hash values are sourced from external inputs

How to Mitigate CVE-2026-0933

Immediate Actions Required

• Upgrade Wrangler v4 installations to version 4.59.1 or higher immediately
• Upgrade Wrangler v3 installations to version 3.114.17 or higher
• Migrate from Wrangler v2 (End of Life) to a supported major version
• Audit CI/CD pipelines to identify where --commit-hash parameters are populated from external sources

Patch Information

Cloudflare has released security patches addressing this vulnerability:

For more information, refer to the Cloudflare Workers SDK repository.

Workarounds

• Validate --commit-hash input to ensure it contains only valid hexadecimal characters (matching git commit hash format)
• Avoid populating --commit-hash from untrusted external sources in CI/CD pipelines
• Implement input sanitization layers before passing values to Wrangler commands
• Use environment isolation for CI/CD runners processing external inputs

# Example: Validate commit hash format before passing to Wrangler
# Ensure commit hash only contains valid hexadecimal characters
if [[ ! "$COMMIT_HASH" =~ ^[a-fA-F0-9]{40}$ ]]; then
    echo "Invalid commit hash format detected"
    exit 1
fi
wrangler pages deploy --commit-hash="$COMMIT_HASH"