An argument injection vulnerability (CWE-88) exists in PrefectHQ Prefect versions up to 3.8.2. The vulnerability arises because the branch parameter in the git_clone pull step is passed directly to the git pull command without sanitization. Authenticated users can exploit this to inject arbitrary git arguments, resulting in remote code execution on the Prefect server. This is a separate code path from the incomplete fix applied for CVE-2026-5366, indicating that the prior remediation did not address this vector. The CVSS 3.1 score is 8.8, reflecting high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows authenticated users to execute arbitrary commands on the Prefect server via injection of git arguments. This can lead to full compromise of the server, including unauthorized access to data, modification of workflows, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and carefully validate or sanitize inputs to the git_clone pull step branch field to prevent injection. Monitor PrefectHQ advisories for updates and patches addressing this vulnerability.