Read the docs
TI-2022-13282 Aliases CVE-2022-31249GHSA-qrg7-hfx7-95c5

[RANCHER] OS command injection in Rancher and Fleet

Priority MEDIUM 49CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03759 89th percentileScored 2026-11-07
Fix Fixed github.com/rancher/wrangler (Go): 0.7.4-security1, 0.8.5-security1, 1.0.1 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSERancherwrangler – 0.7.3—No fix listedCNA
—github.com/rancher/wrangler (Go)before 0.7.4-security10.7.4-security1Patch availableGHSA-qrg7-hfx7-95c5
—github.com/rancher/wrangler (Go)0.8.0 to before 0.8.5-security10.8.5-security1Patch availableGHSA-qrg7-hfx7-95c5
—github.com/rancher/wrangler (Go)1.0.0 to before 1.0.11.0.1Patch availableGHSA-qrg7-hfx7-95c5
—github.com/rancher/wrangler (Go)0.8.6 to before 0.8.110.8.11Patch availableGHSA-qrg7-hfx7-95c5
  • Rancher VendorSUSE Affected wrangler – 0.7.3 Fixed in — No fix listed CNA
  • github.com/rancher/wrangler (Go) Vendor— Affected before 0.7.4-security1 Fixed in 0.7.4-security1 Patch available GHSA-qrg7-hfx7-95c5
  • github.com/rancher/wrangler (Go) Vendor— Affected 0.8.0 to before 0.8.5-security1 Fixed in 0.8.5-security1 Patch available GHSA-qrg7-hfx7-95c5
  • github.com/rancher/wrangler (Go) Vendor— Affected 1.0.0 to before 1.0.1 Fixed in 1.0.1 Patch available GHSA-qrg7-hfx7-95c5
  • github.com/rancher/wrangler (Go) Vendor— Affected 0.8.6 to before 0.8.11 Fixed in 0.8.11 Patch available GHSA-qrg7-hfx7-95c5

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:suse:wrangler:*:*:*:*:*:*:*:*before 0.7.4; 0.8.0 to before 0.8.5VulnerableSUSE
cpe:2.3:a:suse:wrangler:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableSUSE
  • cpe:2.3:a:suse:wrangler:*:*:*:*:*:*:*:* Versions before 0.7.4; 0.8.0 to before 0.8.5 Vulnerable ·SUSE
  • cpe:2.3:a:suse:wrangler:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·SUSE

Remediation

  • Fix · GHSA-qrg7-hfx7-95c5 github.com/rancher/wrangler (Go) Fixed in 0.7.4-security1 Advisory →
  • Fix · GHSA-qrg7-hfx7-95c5 github.com/rancher/wrangler (Go) Fixed in 0.8.5-security1 Advisory →
  • Fix · GHSA-qrg7-hfx7-95c5 github.com/rancher/wrangler (Go) Fixed in 1.0.1 Advisory →
  • Fix · GHSA-qrg7-hfx7-95c5 github.com/rancher/wrangler (Go) Fixed in 0.8.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31249
  2. 2026-10-03 Alias added: GHSA-qrg7-hfx7-95c5

References

Advisory 2

Other 10

  • TI-2022-21490 Rancher/Wrangler: Denial of service when processing Git credentials CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences