https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T22:22:37.518618+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-268268 EUVD-2026-268268 2026-10-12T22:22:37.562942+00:00 EUVD-2026-268268 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26056 fkie_cve-2026-26056 2026-10-12T22:22:37.562972+00:00

Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the overrides.yoke.cd/flight annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.

 https://cve.radiocsirt.org/vuln/ghsa-wj8p-jj64-h7ff GHSA-wj8p-jj64-h7ff — Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC 2026-10-12T22:22:37.563004+00:00

Affected: Go: github.com/yokecd/yoke

# Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC

This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.

**Recommended CWE**: CWE-94 (Improper Control of Generation of Code - Code Injection)

## Summary

Yoke ATC allows users to override the Flight WASM module URL via the `overrides.yoke.cd/flight` annotation on Custom Resources. The controller only checks if the user has `update` permission on `airways` resources but does not validate the WASM URL source. An attacker with CR create/update permissions can inject a malicious WASM URL, causing the ATC controller to download and execute arbitrary code.

## Details

The vulnerability exists in two code paths:

**Source Point - Annotation Definition** (`pkg/flight/flight.go:41-42`): ```go const ( AnnotationOverrideFlight = "overrides.yoke.cd/flight" AnnotationOverrideMode = "overrides.yoke.cd/mode" ) ```

**Sink Point 1 - Admission Webhook** (`cmd/atc/handler.go:298-300`): ```go if overrideURL, _, _ := unstructured.NestedString(cr.Object,…