GHSA-GJQQ-6R35-W3R8
Vulnerability from github – Published: 2026-01-15 20:10 – Updated: 2026-01-15 22:33Summary
Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation.
Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container.
If the container is configured with host volume mounts in its Compose definition, the executed command may be able to read from or write to the host filesystem through the mounted paths. This can enable data theft and, in some configurations, escalation to full host compromise (for example, if /var/run/docker.sock is mounted).
Impact
- Remote code execution (RCE) within the updated container context.
- Host filesystem access when host volumes are mounted into the container.
- Potential data exfiltration via outbound network requests or by exposing readable files.
- Potential full host compromise if sensitive mounts are present (e.g., /var/run/docker.sock).
Patches
The lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update have been removed to eliminate this attack surface.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/getarcaneapp/arcane/backend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260114065515-5a9c2f92e11f"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23520"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-15T20:10:11Z",
"nvd_published_at": "2026-01-15T20:16:05Z",
"severity": "CRITICAL"
},
"details": "## Summary\n\nArcane\u2019s updater service supported lifecycle labels `com.getarcaneapp.arcane.lifecycle.pre-update` and `com.getarcaneapp.arcane.lifecycle.post-update` that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation.\n\nBecause any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container.\n\nIf the container is configured with host volume mounts in its Compose definition, the executed command may be able to read from or write to the host filesystem through the mounted paths. This can enable data theft and, in some configurations, escalation to full host compromise (for example, if /var/run/docker.sock is mounted).\n\n### Impact\n\n- Remote code execution (RCE) within the updated container context.\n- Host filesystem access when host volumes are mounted into the container.\n- Potential data exfiltration via outbound network requests or by exposing readable files.\n- Potential full host compromise if sensitive mounts are present (e.g., /var/run/docker.sock).\n\n### Patches\nThe lifecycle labels `com.getarcaneapp.arcane.lifecycle.pre-update` and `com.getarcaneapp.arcane.lifecycle.post-update` have been removed to eliminate this attack surface.",
"id": "GHSA-gjqq-6r35-w3r8",
"modified": "2026-01-15T22:33:55Z",
"published": "2026-01-15T20:10:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23520"
},
{
"type": "WEB",
"url": "https://github.com/getarcaneapp/arcane/pull/1468"
},
{
"type": "WEB",
"url": "https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4"
},
{
"type": "PACKAGE",
"url": "https://github.com/getarcaneapp/arcane"
},
{
"type": "WEB",
"url": "https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.