HashBrown CMS through version 1.4.6 has an OS Command Injection vulnerability (CWE-78) in the Git deployer component. Specifically, the GitDeployer.pullRepo() function executes a shell command to checkout a Git branch using unescaped user-controlled input for the branch name. The validation only rejects single-quote characters but does not filter other shell metacharacters such as semicolons, ampersands, pipes, backticks, or command substitution syntax. An attacker who can configure the Git deployer settings can inject malicious shell commands via the branch name, which will be executed automatically on each deployer operation. This vulnerability is a continuation of a prior fix that did not cover the branch field.

An attacker with the ability to configure the Git deployer settings can execute arbitrary OS commands on the server hosting HashBrown CMS. This can lead to full system compromise, data theft, or disruption of service. The vulnerability is triggered automatically during routine deployer operations, increasing the risk of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Git deployer configuration to trusted users only. Avoid using untrusted input for the branch name in deployer settings. Monitor for unusual deployer activity and consider disabling automatic deployer operations if feasible.