CVE-2026-0933
1 advisory.
npm/wrangler CVE-2026-0933: high
Wrangler affected by OS Command Injection in `wrangler pages deploy`
Action: Upgrade wrangler to 3.114.17 or later.
npm i wrangler@3.114.17npm i wrangler@4.59.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.15 | 3.114.17 | - |
| 4.0.0 | 4.59.1 | - |
Fixed versions
| 3.114.17 | 4.59.1 |
Sources
- osv: GHSA-36p8-mvp6-cv38
- https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-36p8-mvp6-cv38
- https://nvd.nist.gov/vuln/detail/CVE-2026-0933
- https://github.com/cloudflare/workers-sdk/commit/99b1f328a9afe181b49f1114ed47f15f6d25f0be
- https://github.com/cloudflare/workers-sdk
- https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%403.114.17
- https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.59.1
CVE-2026-0933 · published · modified · JSON