CVE-2026-79754
Severity not reportedNuclio is a "Serverless" framework for Real-Time Events and Data Processing.
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252 security-advisories@github.com
- https://github.com/nuclio/nuclio/pull/4190 security-advisories@github.com
- https://github.com/nuclio/nuclio/releases/tag/1.17.2 security-advisories@github.com
- https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72 security-advisories@github.com
- https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72 134c704f-9b21-4f2e-91b3-4a467353bcc0