HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/D…

HashBrown CMS through version 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in its Git deployer component. The GitDeployer.pullRepo() function in GitDeployer.js directly interpolates a user-configured branch value into a shell command without proper escaping. The existing validation in GitDeployer.validate() only filters single-quote characters, leaving shell metacharacters such as semicolons, double ampersands, pipes, backticks, and $() unfiltered. An authenticated user with access to project Git deployer settings can inject malicious commands via the branch field, which execute automatically on every deployer operation including media uploads and content saves. This vulnerability is related to CVE-2020-6948, which partially addressed command injection in the same file but failed to cover the branch field used in the git checkout command. The flaw enables persistent arbitrary OS command execution on the server for any user with deployer configuration access.