CVE-2026-23520
Prior to 1.13.0, Arcane has a command injection in the updater service.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.87%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.
- CVSS 3.1
- 8.0 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.87% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- arcane/arcane
- Source
- security-advisories@github.com
References
- https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4Exploit
- https://github.com/getarcaneapp/arcane/pull/1468Issue Tracking
- https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0Release Notes
- https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.