CVE-2026-23520

Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4	Exploit
https://github.com/getarcaneapp/arcane/pull/1468	Issue Tracking
https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0	Release Notes
https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arcane:arcane:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-15 20:16

Updated : 2026-06-17 10:21

NVD link : CVE-2026-23520

Mitre link : CVE-2026-23520

CVE.ORG link : CVE-2026-23520

JSON object : View

Products Affected

arcane

arcane

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-23520", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23520", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-15T19:58:38.291447Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getarcaneapp", "product": "arcane", "versions": [{"status": "affected", "version": "< 1.13.0"}]}]}], "published": "2026-01-15T20:16:05.467", "references": [{"url": "https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4", "tags": ["Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getarcaneapp/arcane/pull/1468", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane\u2019s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0."}, {"lang": "es", "value": "Arcane proporciona gesti\u00f3n moderna de Docker. Antes de 1.13.0, Arcane tiene una inyecci\u00f3n de comandos en el servicio de actualizaci\u00f3n. El servicio de actualizaci\u00f3n de Arcane soportaba etiquetas de ciclo de vida com.getarcaneapp.arcane.lifecycle.pre-update y com.getarcaneapp.arcane.lifecycle.post-update que permit\u00edan definir un comando para ejecutar antes o despu\u00e9s de una actualizaci\u00f3n de contenedor. El valor de la etiqueta se pasa directamente a /bin/sh -c sin saneamiento ni validaci\u00f3n. Debido a que cualquier usuario autenticado (no limitado a administradores) puede crear proyectos a trav\u00e9s de la API, un atacante puede crear un proyecto que especifica una de estas etiquetas de ciclo de vida con un comando malicioso. Cuando un administrador m\u00e1s tarde activa una actualizaci\u00f3n de contenedor (ya sea manualmente o mediante comprobaciones de actualizaci\u00f3n programadas), Arcane lee la etiqueta de ciclo de vida y ejecuta su valor como un comando de shell dentro del contenedor. Esta vulnerabilidad est\u00e1 corregida en 1.13.0."}], "lastModified": "2026-06-17T10:21:43.083", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arcane:arcane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6334A63-DF55-490B-9840-4805617B2E8D", "versionEndExcluding": "1.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}