Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-79756 (GCVE-0-2026-79756)

Vulnerability from nvd – Published: 2026-09-02 16:39 – Updated: 2026-09-03 14:32

Title

Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 14:09 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4223	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/86d4e3938…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.17.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.17.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T14:09:11.271617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T14:32:04.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.17.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:39:57.744Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-mq8w-f7w8-5rgg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-mq8w-f7w8-5rgg"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4223",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4223"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/86d4e39387d8845f567649201798800830f08411",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/86d4e39387d8845f567649201798800830f08411"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.17.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.17.4"
        }
      ],
      "source": {
        "advisory": "GHSA-mq8w-f7w8-5rgg",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-79756",
    "datePublished": "2026-09-02T16:39:57.744Z",
    "dateReserved": "2026-08-25T14:08:18.109Z",
    "dateUpdated": "2026-09-03T14:32:04.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79755 (GCVE-0-2026-79755)

Vulnerability from nvd – Published: 2026-09-02 16:39 – Updated: 2026-09-04 02:45

Title

Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=<value>" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket → host compromise. This issue has been patched in version 1.17.4.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 02:44 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4220	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/24582ac35…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.17.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.17.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79755",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T02:44:52.496401Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T02:45:19.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-2893-rq73-w22x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.17.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated\u2014unvalidated\u2014into a double-quoted docker ps --filter \"label=nuclio.io/namespace=\u003cvalue\u003e\" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket \u2192 host compromise. This issue has been patched in version 1.17.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:39:17.639Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-2893-rq73-w22x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-2893-rq73-w22x"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4220",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4220"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/24582ac354d04951ec6786b3fe6ccf3b32652e9f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/24582ac354d04951ec6786b3fe6ccf3b32652e9f"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.17.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.17.4"
        }
      ],
      "source": {
        "advisory": "GHSA-2893-rq73-w22x",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-79755",
    "datePublished": "2026-09-02T16:39:17.639Z",
    "dateReserved": "2026-08-25T14:08:18.109Z",
    "dateUpdated": "2026-09-04T02:45:19.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79754 (GCVE-0-2026-79754)

Vulnerability from nvd – Published: 2026-09-02 16:38 – Updated: 2026-09-02 18:04

Title

Nuclio: Kaniko build tempDir command injection

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 18:04 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4190	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/e3ed7de65…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.17.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: >= 1.6.19, < 1.17.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79754",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:04:24.122487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:04:52.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.6.19, \u003c 1.17.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio\u0027s Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:38:50.441Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4190",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4190"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.17.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.17.2"
        }
      ],
      "source": {
        "advisory": "GHSA-x44h-qmrv-mh72",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Kaniko build tempDir command injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-79754",
    "datePublished": "2026-09-02T16:38:50.441Z",
    "dateReserved": "2026-08-25T14:08:18.109Z",
    "dateUpdated": "2026-09-02T18:04:52.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52833 (GCVE-0-2026-52833)

Vulnerability from nvd – Published: 2026-09-02 16:38 – Updated: 2026-09-02 18:05

Title

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 18:05 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4149	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/4c78040c7…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.16.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52833",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:05:09.574640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:05:44.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio\u0027s Java runtime generates a build.gradle file during function builds using Go\u0027s text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:38:33.897Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4149",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4149"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/4c78040c759068e927f3ed7c6507543c15d4ae56",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/4c78040c759068e927f3ed7c6507543c15d4ae56"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.16.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.16.5"
        }
      ],
      "source": {
        "advisory": "GHSA-3v79-m2cg-89ww",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52833",
    "datePublished": "2026-09-02T16:38:33.897Z",
    "dateReserved": "2026-06-08T18:11:06.662Z",
    "dateUpdated": "2026-09-02T18:05:44.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52832 (GCVE-0-2026-52832)

Vulnerability from nvd – Published: 2026-09-02 16:38 – Updated: 2026-09-02 19:03

Title

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 19:03 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4143	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/2a55d3a8b…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.16.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52832",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T19:03:14.851759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T19:03:22.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only \u2014 no path validation is applied to the module portion. This issue has been patched in version 1.16.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:38:15.764Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4143",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4143"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/2a55d3a8bd4d49226cb4742020303f5bf2a0931d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/2a55d3a8bd4d49226cb4742020303f5bf2a0931d"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.16.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.16.5"
        }
      ],
      "source": {
        "advisory": "GHSA-wpcj-rmv4-86qg",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52832",
    "datePublished": "2026-09-02T16:38:15.764Z",
    "dateReserved": "2026-06-08T18:11:06.662Z",
    "dateUpdated": "2026-09-02T19:03:22.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52831 (GCVE-0-2026-52831)

Vulnerability from nvd – Published: 2026-09-02 16:40 – Updated: 2026-09-03 14:31

Title

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 14:08 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/commit/3356b86a8…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.16.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52831",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T14:08:01.445028Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T14:31:56.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, \u003ccommand\u003e). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:40:28.765Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.16.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.16.4"
        }
      ],
      "source": {
        "advisory": "GHSA-v5px-423j-pf7p",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52831",
    "datePublished": "2026-09-02T16:40:28.765Z",
    "dateReserved": "2026-06-08T18:11:06.662Z",
    "dateUpdated": "2026-09-03T14:31:56.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45730 (GCVE-0-2026-45730)

Vulnerability from nvd – Published: 2026-09-02 16:15 – Updated: 2026-09-02 18:06

Title

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 18:05 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4107	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/1915cd26d…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.16.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45730",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:05:50.930418Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:06:14.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard\u0027s project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:15:31.615Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4107",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4107"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/1915cd26d514dcdd487517d4be56673fc02298e0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/1915cd26d514dcdd487517d4be56673fc02298e0"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.16.0"
        }
      ],
      "source": {
        "advisory": "GHSA-m8xg-8xg9-mxhm",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45730",
    "datePublished": "2026-09-02T16:15:31.615Z",
    "dateReserved": "2026-05-13T05:51:48.667Z",
    "dateUpdated": "2026-09-02T18:06:14.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-29042 (GCVE-0-2026-29042)

Vulnerability from nvd – Published: 2026-03-06 06:57 – Updated: 2026-03-09 19:57

Title

Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

Severity

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-09 19:56 UTC

CWE

CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4030	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/5352d7e16…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.15.20	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.15.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29042",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T19:56:55.354293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T19:57:06.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-75",
              "description": "CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T06:57:11.332Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-95fj-3w7g-4r27",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-95fj-3w7g-4r27"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4030",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4030"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/5352d7e16cf92f4350a2f8d806c4b80b626b5c5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/5352d7e16cf92f4350a2f8d806c4b80b626b5c5a"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.15.20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.15.20"
        }
      ],
      "source": {
        "advisory": "GHSA-95fj-3w7g-4r27",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio Shell Runtime Command Injection Leading to Privilege Escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-29042",
    "datePublished": "2026-03-06T06:57:11.332Z",
    "dateReserved": "2026-03-03T17:50:11.242Z",
    "dateUpdated": "2026-03-09T19:57:06.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52831 (GCVE-0-2026-52831)

Vulnerability from cvelistv5 – Published: 2026-09-02 16:40 – Updated: 2026-09-03 14:31

Title

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 14:08 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/commit/3356b86a8…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.16.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52831",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T14:08:01.445028Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T14:31:56.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, \u003ccommand\u003e). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:40:28.765Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.16.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.16.4"
        }
      ],
      "source": {
        "advisory": "GHSA-v5px-423j-pf7p",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52831",
    "datePublished": "2026-09-02T16:40:28.765Z",
    "dateReserved": "2026-06-08T18:11:06.662Z",
    "dateUpdated": "2026-09-03T14:31:56.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79756 (GCVE-0-2026-79756)

Vulnerability from cvelistv5 – Published: 2026-09-02 16:39 – Updated: 2026-09-03 14:32

Title

Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 14:09 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4223	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/86d4e3938…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.17.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.17.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T14:09:11.271617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T14:32:04.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.17.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:39:57.744Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-mq8w-f7w8-5rgg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-mq8w-f7w8-5rgg"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4223",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4223"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/86d4e39387d8845f567649201798800830f08411",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/86d4e39387d8845f567649201798800830f08411"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.17.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.17.4"
        }
      ],
      "source": {
        "advisory": "GHSA-mq8w-f7w8-5rgg",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-79756",
    "datePublished": "2026-09-02T16:39:57.744Z",
    "dateReserved": "2026-08-25T14:08:18.109Z",
    "dateUpdated": "2026-09-03T14:32:04.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79755 (GCVE-0-2026-79755)

Vulnerability from cvelistv5 – Published: 2026-09-02 16:39 – Updated: 2026-09-04 02:45

Title

Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=<value>" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket → host compromise. This issue has been patched in version 1.17.4.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 02:44 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4220	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/24582ac35…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.17.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.17.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79755",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T02:44:52.496401Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T02:45:19.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-2893-rq73-w22x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.17.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated\u2014unvalidated\u2014into a double-quoted docker ps --filter \"label=nuclio.io/namespace=\u003cvalue\u003e\" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket \u2192 host compromise. This issue has been patched in version 1.17.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:39:17.639Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-2893-rq73-w22x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-2893-rq73-w22x"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4220",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4220"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/24582ac354d04951ec6786b3fe6ccf3b32652e9f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/24582ac354d04951ec6786b3fe6ccf3b32652e9f"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.17.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.17.4"
        }
      ],
      "source": {
        "advisory": "GHSA-2893-rq73-w22x",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-79755",
    "datePublished": "2026-09-02T16:39:17.639Z",
    "dateReserved": "2026-08-25T14:08:18.109Z",
    "dateUpdated": "2026-09-04T02:45:19.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79754 (GCVE-0-2026-79754)

Vulnerability from cvelistv5 – Published: 2026-09-02 16:38 – Updated: 2026-09-02 18:04

Title

Nuclio: Kaniko build tempDir command injection

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 18:04 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4190	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/e3ed7de65…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.17.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: >= 1.6.19, < 1.17.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79754",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:04:24.122487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:04:52.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.6.19, \u003c 1.17.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio\u0027s Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:38:50.441Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4190",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4190"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.17.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.17.2"
        }
      ],
      "source": {
        "advisory": "GHSA-x44h-qmrv-mh72",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Kaniko build tempDir command injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-79754",
    "datePublished": "2026-09-02T16:38:50.441Z",
    "dateReserved": "2026-08-25T14:08:18.109Z",
    "dateUpdated": "2026-09-02T18:04:52.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52833 (GCVE-0-2026-52833)

Vulnerability from cvelistv5 – Published: 2026-09-02 16:38 – Updated: 2026-09-02 18:05

Title

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 18:05 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4149	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/4c78040c7…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.16.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52833",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:05:09.574640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:05:44.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio\u0027s Java runtime generates a build.gradle file during function builds using Go\u0027s text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:38:33.897Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-3v79-m2cg-89ww"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4149",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4149"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/4c78040c759068e927f3ed7c6507543c15d4ae56",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/4c78040c759068e927f3ed7c6507543c15d4ae56"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.16.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.16.5"
        }
      ],
      "source": {
        "advisory": "GHSA-3v79-m2cg-89ww",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52833",
    "datePublished": "2026-09-02T16:38:33.897Z",
    "dateReserved": "2026-06-08T18:11:06.662Z",
    "dateUpdated": "2026-09-02T18:05:44.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52832 (GCVE-0-2026-52832)

Vulnerability from cvelistv5 – Published: 2026-09-02 16:38 – Updated: 2026-09-02 19:03

Title

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 19:03 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4143	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/2a55d3a8b…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.16.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52832",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T19:03:14.851759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T19:03:22.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only \u2014 no path validation is applied to the module portion. This issue has been patched in version 1.16.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:38:15.764Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4143",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4143"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/2a55d3a8bd4d49226cb4742020303f5bf2a0931d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/2a55d3a8bd4d49226cb4742020303f5bf2a0931d"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.16.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.16.5"
        }
      ],
      "source": {
        "advisory": "GHSA-wpcj-rmv4-86qg",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52832",
    "datePublished": "2026-09-02T16:38:15.764Z",
    "dateReserved": "2026-06-08T18:11:06.662Z",
    "dateUpdated": "2026-09-02T19:03:22.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45730 (GCVE-0-2026-45730)

Vulnerability from cvelistv5 – Published: 2026-09-02 16:15 – Updated: 2026-09-02 18:06

Title

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 18:05 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4107	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/1915cd26d…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.16.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45730",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:05:50.930418Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:06:14.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard\u0027s project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T16:15:31.615Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4107",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4107"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/1915cd26d514dcdd487517d4be56673fc02298e0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/1915cd26d514dcdd487517d4be56673fc02298e0"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.16.0"
        }
      ],
      "source": {
        "advisory": "GHSA-m8xg-8xg9-mxhm",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45730",
    "datePublished": "2026-09-02T16:15:31.615Z",
    "dateReserved": "2026-05-13T05:51:48.667Z",
    "dateUpdated": "2026-09-02T18:06:14.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-29042 (GCVE-0-2026-29042)

Vulnerability from cvelistv5 – Published: 2026-03-06 06:57 – Updated: 2026-03-09 19:57

Title

Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

Summary

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

Severity

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-09 19:56 UTC

CWE

CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/nuclio/nuclio/security/advisor…	x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4030	x_refsource_MISC
https://github.com/nuclio/nuclio/commit/5352d7e16…	x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.15.20	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nuclio	nuclio	Affected: < 1.15.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29042",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T19:56:55.354293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T19:57:06.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclio",
          "vendor": "nuclio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-75",
              "description": "CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T06:57:11.332Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuclio/nuclio/security/advisories/GHSA-95fj-3w7g-4r27",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuclio/nuclio/security/advisories/GHSA-95fj-3w7g-4r27"
        },
        {
          "name": "https://github.com/nuclio/nuclio/pull/4030",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/pull/4030"
        },
        {
          "name": "https://github.com/nuclio/nuclio/commit/5352d7e16cf92f4350a2f8d806c4b80b626b5c5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/commit/5352d7e16cf92f4350a2f8d806c4b80b626b5c5a"
        },
        {
          "name": "https://github.com/nuclio/nuclio/releases/tag/1.15.20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuclio/nuclio/releases/tag/1.15.20"
        }
      ],
      "source": {
        "advisory": "GHSA-95fj-3w7g-4r27",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclio Shell Runtime Command Injection Leading to Privilege Escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-29042",
    "datePublished": "2026-03-06T06:57:11.332Z",
    "dateReserved": "2026-03-03T17:50:11.242Z",
    "dateUpdated": "2026-03-09T19:57:06.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

16 vulnerabilities by nuclio

CVE-2026-79756 (GCVE-0-2026-79756)

CVE-2026-79755 (GCVE-0-2026-79755)

CVE-2026-79754 (GCVE-0-2026-79754)

CVE-2026-52833 (GCVE-0-2026-52833)

CVE-2026-52832 (GCVE-0-2026-52832)

CVE-2026-52831 (GCVE-0-2026-52831)

CVE-2026-45730 (GCVE-0-2026-45730)

CVE-2026-29042 (GCVE-0-2026-29042)

CVE-2026-52831 (GCVE-0-2026-52831)

CVE-2026-79756 (GCVE-0-2026-79756)

CVE-2026-79755 (GCVE-0-2026-79755)

CVE-2026-79754 (GCVE-0-2026-79754)

CVE-2026-52833 (GCVE-0-2026-52833)

CVE-2026-52832 (GCVE-0-2026-52832)

CVE-2026-45730 (GCVE-0-2026-45730)

CVE-2026-29042 (GCVE-0-2026-29042)