CVE-2026-92892

jfrog-cli: Potential command execution on the host running JFrog CLI.

jfrog jfrog-cli

CVSS

9.0Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in2.128.0Fixed versionCVE List

Published13 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

2.128.0jfrog-cliCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.

Text from CVE List

Affected versions 1

jfrog-cliaffected: all versions before 2.128.0CVE List

References 2

docs.jfrog.com/releases/docs/jfrog-security-advisoriesAdvisoryvia CVE List
github.com/jfrog/jfrog-cli/releasesAdvisoryvia CVE List