TI-2026-00705 CVE-2026-0933 · GHSA-36p8-mvp6-cv38
OS Command Injection in `wrangler pages deploy`
Priority LOW 39
SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command.
Cloudflare
Records70All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high44CVSS 7.0–8.9
Exploited now
Cloudflare records in CISA KEVNo Cloudflare vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records in Wrangler · all components
TI-2023-06476 CVE-2023-7080 · GHSA-f8mp-x433-5wpf
Arbitrary remote code execution within wrangler dev Workers sandbox
Priority LOW 38
The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging.
TI-2023-06475 CVE-2023-7079 · GHSA-cfph-4qqh-w828
Arbitrary remote file read in Wrangler dev server
Priority LOW 30
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network.
TI-2023-03133 CVE-2023-3348 · GHSA-8c93-4hch-xgxp
Directory traversal vulnerability in Cloudflare Wrangler
Priority LOW 27
The Wrangler command line tool (<[email protected] or <[email protected]) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command).