{"id":"CVE-2026-23520","aliases":["GHSA-gjqq-6r35-w3r8","GO-2026-4320"],"url":"https://o3.security/vulnerability/CVE-2026-23520","summary":"Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE","details":"Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.","published":"2026-01-15T19:20:22.434Z","modified":"2026-08-07T11:50:30.132127456Z","cvss":{"score":9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/getarcaneapp/arcane/backend","fixedVersion":"0.0.0-20260114065515-5a9c2f92e11f"}],"fix":{"url":"https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4","label":"getarcaneapp/arcane@5a9c2f9"},"references":[{"type":"WEB","url":"https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23520.json"},{"type":"ADVISORY","url":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23520"},{"type":"FIX","url":"https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4"},{"type":"FIX","url":"https://github.com/getarcaneapp/arcane/pull/1468"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:50:30.132127456Z"}}