fkie_cve-2026-52833

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5.

GHSA-3v79-m2cg-89ww — Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Affected: Go: github.com/nuclio/nuclio

## Summary

Nuclio's Java runtime generates a `build.gradle` file during function builds using Go's `text/template` package. The template renders `runtimeAttributes.repositories[]` values with the `{{ . }}` action, which performs no escaping. An attacker can embed a closing brace (`}`) to break out of the `repositories {}` block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase.

The Dashboard API runs with NOP authentication by default, so no credentials are required. The build container runs as root. The injected command output confirmed by dynamic testing:

``` [RCE-PROOF] uid=0(root) gid=0(root) groups=0(root) nuclio-kanikojob.nuclioprocessorvul006rcev3latest.tkxsslz06ppcr root BUILD SUCCESSFUL in 512ms ```

- **CWE**: CWE-94 (Improper Control of Generation of Code / Code Injection) - **Affected versions**: Nuclio <= 1.15.27 (latest as of 2026-05-17, dynamically verified)

---

## Details

### Root Cause

`pkg/processor/build/runtime/java/runtime.go` — function `createGradleBuildScript()`

**Step 1. User input flows from the API into the template data map without validation**

`types.go:50-64` — `newBuildAttributes()` decodes `runtimeAttributes` with no content inspection. Any string is accepted for each element of `Repositories`:

```go // pkg/processor/build/runtime/java/types.go:50-64 func newBuildAttributes(encodedBuildAttributes map[string]interface{}) (*buildAttributes, error) { newBuildAttributes := build…

Most recent entries from all

fkie_cve-2026-52833

GHSA-3v79-m2cg-89ww — Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE