CVE-2026-23520
Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE
Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.
- Affected
- getarcaneapp · arcane
- CVSS v3.1 NVD
- 8.0 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1 GITHUB
- 9.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - EPSS
- 1.85% chance of exploitation in the next 30 days, 79th percentile
- Published
- 2026-01-15
Proof-of-concept exploits (3)
- Augmaster/POC-CVE-2026-235202★ · 2026-03-21
- cypher-21/CVE-2026-235202★ · 2026-03-23
- kikechans/-Educational-PoC-CVE-2026-235200★ · 2026-05-24
Security advisories
- getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8
- advisories/GHSA-gjqq-6r35-w3r8
- getarcaneapp/arcane/pull/1468