CVE-2026-79754
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing.
Impact
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252
- https://github.com/nuclio/nuclio/pull/4190
- https://github.com/nuclio/nuclio/releases/tag/1.17.2
- https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72
- https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72