CVE-2026-92892: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in jfrog jfrog-cli

This vulnerability (CVE-2026-92892) in jfrog-cli is classified as CWE-88, which involves improper neutralization of argument delimiters in a command, commonly known as argument injection. This flaw can allow an attacker to execute arbitrary code if certain configurations are met. The affected versions are all jfrog-cli releases from 0 through 2.126.0 inclusive. The CVSS 3.1 base score is 9.0, with network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change, resulting in high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected system. Given the high CVSS score and the nature of the flaw, attackers can potentially execute commands remotely without authentication under specific configurations.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should review their configurations to minimize exposure to argument injection risks and monitor official jfrog communications for updates.