{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-85979",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-85979",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-11T14:40:53.491Z",
    "updatedAt": "2026-09-16T09:49:14.319Z",
    "importedAt": "2026-10-24T01:58:35.090Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Command Injection in Puppet Enterprise",
      "summary": "Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system. \n\nIt affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2.\n\n\n\nThis has been resolved in Puppet Enterprise 2023.8.11 and Puppet Enterprise 2025.11.3.",
      "affected": [
        {
          "vendor": "Perforce Software",
          "product": "Puppet Enterprise",
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2023.8.0",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "2023.8.10"
            },
            {
              "version": "2025.0.0",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "2025.11.2"
            },
            {
              "version": "2023.8.11",
              "status": "unaffected",
              "versionType": "semver"
            },
            {
              "version": "2025.11.3",
              "status": "unaffected",
              "versionType": "semver"
            }
          ]
        }
      ]
    }
  }
}