JFrog CLI: Potential command execution on host running the CLI
Summary
JFrog CLI (jf) versions before 2.128.0 can allow command execution on the host that runs the CLI under specific configurations. The CNA lists versions from 0 to below 2.128.0 as affected, including v2.127.0, and NVD scores the issue CVSS 9.0 (Critical) with network access and no user interaction, but high attack complexity. The main risk lies on CI/CD runners, build agents and developer machines where the CLI is installed.
Affected
- JFrog CLI (jfrog-cli) from 0 to below 2.128.0 according to the CNA record
- v2.127.0 is also affected, according to the vendor update
- The exact trigger configurations are not described in the sources.
Fixed in
- Upgrade to JFrog CLI v2.128.0 or later.
- v2.127.0, which first contained a fix, is incomplete and must not be used.
Workaround
Unknown.
Exploitation
- No evidence of in-the-wild exploitation in the sources.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No public proof of concept found.
- EPSS score is low (0.0034).
Our recommendation
- Inventory all hosts with the jf command, including CI runners and developer machines, and record the version.
- Upgrade every installation at v2.127.0 or earlier to v2.128.0 or later.
- Check Linux distribution packages (for example openSUSE, Nixpkgs) for updated builds.
- Restrict who can run the CLI on shared build systems until patched.
- Monitor the NVD and JFrog advisory entries, since the NVD status is still Awaiting Analysis and the CWE classification differs between sources (CWE-88 vs. CWE-77).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JFrog Security Advisories docs.jfrog.com
- JFrog CLI GitHub releases github.com
- JFrog CLI Security fix pull request #918 github.com
- VulDB entry CVE-2026-92892 vuldb.com
- Nixpkgs issue #574303 github.com
- openSUSE advisory OPENSUSE-SU-2026:12130-1 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:12.
Original description (NVD)
Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.