Development and collaboration software company Atlassian has published a security advisory urging their customers to patch a critical command injection vulnerability existing in multiple API endpoints for their Bitbucket Data Center and Server products. These software solutions allow organizations to self-manage source code collaboration for their professional development teams. A feature of Bitbucket Data Center and Server is the ability for administrators to allow public access to their code repositories. This open-source cloud development methodology allows unauthenticated users across any distance to browse specific repositories or entire projects. It also allows those anonymous users to clone repositories, without needing to have a Bitbucket account. If successfully exploited, the flaw, tracked as CVE-2022-36804, could allow attackers with access to a public repository or with read permissions to a private Bitbucket repository to send maliciously crafted HTTP packets to a vulnerable instance, allowing for arbitrary remote code execution (RCE). Security researcher Max Garrett first identified this vulnerability and reported it to Atlassian as part of their bug bounty program. In a Twitter post, Garrett promised to publish a proof-of-concept (PoC) exploit for this flaw in the next thirty (30) days, giving organizations time to patch their vulnerable instances. This vulnerability is potentially very dangerous, with a CVSS score of 9.9/10, and CTIX analysts recommend that system administrators apply the latest patch immediately. If the negative impact to critical business processes is too great to update all at once, then administrators should apply a temporary mitigation using “feature.public.access=false” to turn off public repositories, meaning that only authorized users have access. It should be noted however, that this is not a full-proof plan, and attackers who gain access to the affected platforms via stolen credentials would still be able to exploit this vulnerability.