What’s Vulnerable › Vulnerabilities

CVE-2026-92892: Potential command execution on the host running JFrog CLI.

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-22
• Weakness: CWE-88

Description

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.

Affected products

• jfrog-cli: before 2.128.0 — fixed in 2.128.0

How to fix

Upgrade to a fixed version: jfrog-cli 2.128.0. Check the vendor advisory for mitigations.

References

• https://docs.jfrog.com/releases/docs/jfrog-security-advisories
• https://github.com/jfrog/jfrog-cli/releases

Get alerted when CVE-2026-92892 or the next vulnerability affects your stack