Command Injection Affecting galaxy-ng package, versions [0,]
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-GALAXYNG-17675132
- published29 Jun 2026
- disclosed16 Jun 2026
- creditUnknown
Introduced: 16 Jun 2026
CVE-2026-12398 (opens in a new tab)How to fix?
There is no fixed version for galaxy-ng.
Overview
galaxy-ng is a galaxy-ng plugin for the Pulp Project
Affected versions of this package are vulnerable to Command Injection in the do_git_checkout process. An attacker can execute arbitrary commands on the system by supplying a git branch or tag name containing shell metacharacters, which are then interpolated into shell commands executed with elevated privileges. This is only exploitable if the GALAXY_ENABLE_LEGACY_ROLES setting is explicitly set to True, enabling the legacy role import API endpoint.
Workaround
This vulnerability can be mitigated by ensuring that GALAXY_ENABLE_LEGACY_ROLES is set to False in the configuration, restricting API access to trusted users, and monitoring import activity for suspicious git references.