CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2026-92892

Potential command execution on the host running JFrog CLI.

Status: Published
Published: 2026-10-13
Updated: 2026-10-22
Assigning organization: JFROG

Description

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jfrog jfrog-cli

Default version status: unaffected

0 to < 2.128.0affected

References

https://docs.jfrog.com/releases/docs/jfrog-security-advisories ↗
https://github.com/jfrog/jfrog-cli/releases ↗