Log in Start free

Vulnerability · Published Jan 15, 2026 · Assigned by GitHub_M

CVE-2026-23520Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE

Critical 9.1

In plain English

A critical-severity OS command injection in arcane from getarcaneapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.8%top 20.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/getarcaneapp/arcane/backend0.0.0-20260114065515-5a9c2f92e11fGHSA-gjqq-6r35-w3r8
Gogithub.com/getarcaneapp/arcane/backend0.0.0-20260114065515-5a9c2f92e11fGO-2026-4320

Affected products (as reported)

VendorProductVersions
getarcaneapp arcane < 1.13.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References