Remote code execution in dependabot-core branch names when cloning

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.7 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS

• CVE-2020-26222: 3.09% estimated exploitation activity in the next 30 days; percentile 87.72 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact Remote code execution vulnerability in dependabot-common and dependabot-gomodules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. When Dependabot is configured to clone the source repository during an update, Dependabot runs a shell command to git clone the repository: Dependabot will always clone the source repository for gomodules during the file fetching step and can be configured to clone the repository for other package managers using the FileFetcher class from dependabot-common. Patches The fix was applied to version 0.125.1: https://github.com/dependabot/dependabot-core/pull/2727 Workarounds Escape the branch name prior to passing it to the Dependabot::Source class. For example using shellwords:

Published by the source

13 Nov 2020, 15:47 UTC

Last modified by the source

6 Nov 2023, 05:01 UTC

Source last checked

26 Oct 2026, 15:48 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-23f7-99jx-m54r

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2020-26222

Advisory: Remote code execution in dependabot-core branch names when cloning
IDs: CVE-2020-26222, GHSA-23f7-99jx-m54r
Record: https://patchnext.com/advisories/cve-2020-26222 (revision 1, source checked 26 Oct 2026, 15:48 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.7)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: dependabot-omnibus 0.125.1; dependabot-common 0.125.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- RubyGems dependabot-omnibus: affected >= 0.119.0.beta1, < 0.125.1; fixed in 0.125.1
- RubyGems dependabot-common: affected >= 0.119.0.beta1, < 0.125.1; fixed in 0.125.1

## Suggested inspection (read-only)
- RubyGems dependabot-omnibus: check the installed version with your package manager.
- RubyGems dependabot-common: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on dependabot-omnibus, dependabot-common.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-23f7-99jx-m54r (GitHub-reviewed advisory GHSA-23f7-99jx-m54r lists affected ranges: RubyGems dependabot-omnibus >=0.119.0.beta1 =0.119.0.beta1 <0.125.1)

Commands are suggestions: review each one before running it.