Command Injection Vulnerability in Cloudflare Wrangler

CVE-2026-0933

What is CVE-2026-0933?

A command injection vulnerability has been identified in Cloudflare's Wrangler tool, specifically within the wrangler pages deploy command. This issue arises from the lack of proper validation or sanitization of the --commit-hash parameter, which is directly used in a shell command execution context. Attackers controlling the --commit-hash can potentially execute arbitrary shell commands on systems running Wrangler, especially in CI/CD environments. This vulnerability poses significant risks such as the ability to run any shell command including exfiltrating sensitive environment variables or modifying build artifacts. Users are urged to update to the latest Wrangler versions to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References