https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T13:13:26.948127+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-52831 fkie_cve-2026-52831 2026-09-30T13:13:28.492535+00:00

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.

 https://vulnerability.circl.lu/vuln/ghsa-v5px-423j-pf7p GHSA-v5px-423j-pf7p — Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE 2026-09-30T13:13:28.492667+00:00

Affected: Go: github.com/nuclio/nuclio

## Summary

Nuclio controller builds a `curl` invocation string for each cron trigger and stores it as the `args` of a Kubernetes CronJob container (`/bin/sh`, `-c`, `<command>`). Two fields in the trigger specification flow into this string without adequate sanitization:

- `event.headers` keys — interpolated verbatim inside double-quoted `--header` arguments (`lazy.go:2150`); any key containing `"` breaks the quoting context. - `event.body` — processed with `strconv.Quote`, which escapes `"` and `\` but not `$()`, allowing command substitution (`lazy.go:2188`).

Both paths were dynamically verified on Nuclio 1.15.27 (latest as of 2026-05-17).

- **CVSS 3.1**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — **9.9 (Critical)** - **CWE**: CWE-78 (Improper Neutralization of Special Elements used in an OS Command) - **Affected versions**: Nuclio <= 1.15.27 (latest, dynamically verified)

---

## Details

### Root Cause

When a NuclioFunction with a `cron` trigger is reconciled by the controller, it calls `generateCronTriggerCronJobSpec` in `pkg/platform/kube/functionres/lazy.go:2113`. This function builds a shell command string by concatenating user-supplied values and passes it directly to `/bin/sh -c`.

**Path-A — Header key injection (`lazy.go:2146-2151`)**

```go // lazy.go:2146-2151 headersAsCurlArg := "" for headerKey := range attributes.Event.Headers { headerValue := attributes.Event.GetHeaderString(headerKey) headersAsCurlArg = fmt.Sprintf("%s --header \"%s: %s…