id: PYSEC-2026-2486
published: "2026-07-13T15:46:17.919996Z"
modified: "2026-07-13T16:04:06.822401Z"
aliases:
- CVE-2026-12398
- GHSA-6hw7-j4jw-wpff
summary: "Galaxy NG: command injection vulnerability"
details: A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.
affected:
- package:
    name: galaxy-ng
    ecosystem: PyPI
    purl: pkg:pypi/galaxy-ng
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 4.9.2
  versions:
  - 4.2.0
  - 4.2.0a10
  - 4.2.0a12
  - 4.2.0a3
  - 4.2.0a4
  - 4.2.0a5
  - 4.2.0a6
  - 4.2.0a7
  - 4.2.0a8
  - 4.2.0a9
  - 4.2.0b1
  - 4.2.0b2
  - 4.2.0b3
  - 4.2.0rc1
  - 4.2.0rc2
  - 4.2.0rc3
  - 4.2.1
  - 4.2.2
  - 4.2.3
  - 4.2.3b1
  - 4.2.4
  - 4.2.5
  - 4.2.6
  - 4.2.7
  - 4.2.8
  - 4.3.0
  - 4.3.0a1
  - 4.3.0a2
  - 4.3.0b4
  - 4.3.1
  - 4.3.2
  - 4.3.3
  - 4.3.4
  - 4.3.5
  - 4.4.0
  - 4.4.0a1
  - 4.4.0a2
  - 4.4.0b1
  - 4.4.0b2
  - 4.4.1
  - 4.4.2
  - 4.4.3
  - 4.4.4
  - 4.4.5
  - 4.5.0
  - 4.5.0b1
  - 4.5.1
  - 4.5.2
  - 4.5.3
  - 4.5.4
  - 4.5.5
  - 4.6.0
  - 4.6.1
  - 4.6.2
  - 4.6.3
  - 4.6.4
  - 4.6.5
  - 4.6.6
  - 4.7.0
  - 4.7.1
  - 4.7.2
  - 4.7.3
  - 4.8.0
  - 4.8.1
  - 4.9.0
  - 4.9.1
  - 4.9.2
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-12398
- type: WEB
  url: https://access.redhat.com/security/cve/CVE-2026-12398
- type: WEB
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2489180
- type: PACKAGE
  url: https://github.com/ansible/galaxy_ng
- type: PACKAGE
  url: https://pypi.org/project/galaxy-ng
- type: ADVISORY
  url: https://github.com/advisories/GHSA-6hw7-j4jw-wpff
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H