{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-11T14:25:13.510","vulnerabilities":[{"cve":{"id":"CVE-2026-23520","sourceIdentifier":"security-advisories@github.com","published":"2026-01-15T20:16:05.467","lastModified":"2026-02-05T21:37:01.000","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0."},{"lang":"es","value":"Arcane proporciona gestión moderna de Docker. Antes de 1.13.0, Arcane tiene una inyección de comandos en el servicio de actualización. El servicio de actualización de Arcane soportaba etiquetas de ciclo de vida com.getarcaneapp.arcane.lifecycle.pre-update y com.getarcaneapp.arcane.lifecycle.post-update que permitían definir un comando para ejecutar antes o después de una actualización de contenedor. El valor de la etiqueta se pasa directamente a /bin/sh -c sin saneamiento ni validación. Debido a que cualquier usuario autenticado (no limitado a administradores) puede crear proyectos a través de la API, un atacante puede crear un proyecto que especifica una de estas etiquetas de ciclo de vida con un comando malicioso. Cuando un administrador más tarde activa una actualización de contenedor (ya sea manualmente o mediante comprobaciones de actualización programadas), Arcane lee la etiqueta de ciclo de vida y ejecuta su valor como un comando de shell dentro del contenedor. Esta vulnerabilidad está corregida en 1.13.0."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:arcane:arcane:*:*:*:*:*:*:*:*","versionEndExcluding":"1.13.0","matchCriteriaId":"C6334A63-DF55-490B-9840-4805617B2E8D"}]}]}],"references":[{"url":"https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4","source":"security-advisories@github.com","tags":["Exploit"]},{"url":"https://github.com/getarcaneapp/arcane/pull/1468","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}