{"action":"Upgrade prefect to 3.6.25.dev7 or later.","affected":[{"fixed":"3.6.25.dev7","introduced":"0"}],"component":"prefect","cve_ids":["CVE-2026-7725"],"ecosystem":"PyPI","epss":0.00247,"exploited":false,"fixed_versions":["3.6.25.dev7"],"ghsa_id":"GHSA-6rcx-55r6-jx65","id":"tcs_01M5KH2JCTFY2CHWANSSJ1J44N","modified_at":"2026-07-13T16:32:07.135487376Z","published_at":"2026-07-13T15:02:56.814796Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2955","https://nvd.nist.gov/vuln/detail/CVE-2026-7725","https://github.com/PrefectHQ/prefect/pull/21384","https://github.com/PrefectHQ/prefect/commit/6a9d9918716ce4ee0297b69f3046f7067ef1faae","https://gist.github.com/nedlir/c37d90dda5f715790eafc970b2ef0c8a","https://github.com/PrefectHQ/prefect","https://github.com/PrefectHQ/prefect/releases/tag/3.6.25.dev7","https://vuldb.com/submit/807356","https://vuldb.com/vuln/360901","https://vuldb.com/vuln/360901/cti","https://pypi.org/project/prefect","https://github.com/advisories/GHSA-6rcx-55r6-jx65"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2955","url":"https://osv.dev/vulnerability/PYSEC-2026-2955"}],"summary":"Prefect Git Argument Injection in GitRepository Pull Steps"}