CVE-2026-5366 is a critical vulnerability in prefecthq/prefect (version 3.6.23) involving improper control of code generation (CWE-94). The `commit_sha` parameter lacks validation and does not use a `--` separator to distinguish user input from git flags, enabling injection of arbitrary git flags such as `--upload-pack`. Similarly, the `directories` parameter can be exploited during sparse-checkout operations to inject git flags. These issues allow users with deployment creation permissions to execute arbitrary commands on worker machines, threatening multi-tenant shared work pools. The CVSS v3.0 score is 9.9, reflecting high impact on confidentiality, integrity, and availability.

An attacker with deployment creation permissions can execute arbitrary commands on worker machines by injecting malicious git flags through the `commit_sha` and `directories` parameters. This leads to full compromise of the affected systems, including potential control over shared work pools in multi-tenant environments, resulting in complete loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict deployment creation permissions to trusted users only and avoid using affected versions in sensitive environments. Monitor vendor channels for updates and apply patches promptly once released.