https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:24:12 +0000 https://db.gcve.eu/vuln/cve-2026-82804 <p><strong>Affected:</strong> Apache Software Foundation Apache DolphinScheduler</p> <p>The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.</p> <p>An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin&#39;s /test-send endpoint. When the alert script is executed, the shell interprets the injected command, resulting in arbitrary command execution with the privileges of the DolphinScheduler service process.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache DolphinScheduler</p> <p>The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.</p> <p>An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin&#39;s /test-send endpoint. When the alert script is executed, the shell interprets the injected command, resulting in arbitrary command execution with the privileges of the DolphinScheduler service process.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> https://db.gcve.eu/vuln/cve-2026-82804