wrangler

Command-line interface for all things Cloudflare Workers

Latest 4.149.0

91%

Total Score

healthy

Active Cloudflare-backed development, reproducible publishing, and broad contributor activity outweigh workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 28 workflows were analyzed and all action references are pinned, but two workflows use untrusted checkouts and a medium-confidence high-severity bot-conditions finding was reported; two adhoc package installations add minor hygiene risk. Read-only permissions cover 17 workflows, which partly offsets the broader write-permission configuration.

Vulnerabilities

Title	Versions	Severity
CVE-2026-0933 wrangler is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 2.0.15 - 3.114.17 and 4.0.0 - 4.59.1.	2.0.15 - 3.114.174.0.0 - 4.59.1	High
CVE-2023-7080 wrangler is vulnerable to Improper Privilege Management in versions 3.0.0 - 3.19.0 and 2.0.0 - 2.20.2.	2.0.0 - 2.20.23.0.0 - 3.19.0	Critical
CVE-2023-7079 wrangler is vulnerable to Improper Authentication in versions 3.9.0 - 3.19.0.	3.9.0 - 3.19.0	Medium
CVE-2023-3348 wrangler is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 2.20.1.	0.0.0 - 2.20.1	Medium

Package versions

Maintainers

wrangler-publisher

Direct Dependencies

Dependency	Last Release	Score
unenv Version 2.0.0-rc.24	—	—
esbuild Version 0.28.2	—	—
workerd Version 1.20261006.1	—	—
miniflare Version 5.20261006.1-alpha	—	—
blake3-wasm Version 2.1.5	—	—