CVE-2026-33310: intake, инжекция

Описание

Оригинално описание

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.

Засегнати продукти

• intake intake: < 2.0.9

Вид слабост

• CWE-78 Инжектиране на команди към операционната система
• CWE-94 Неправилен контрол при генериране на код

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-33310
• https://nvd.nist.gov/vuln/detail/CVE-2026-33310
• https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99
• https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b